## Ticket: CVE-2026-42574 — apko symlink-following path traversal on apk install

**Advisory**: GHSA-qq3r-w4hj-gjp6 — https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6
**CVE**: CVE-2026-42574 | **CWE-22** (Path Traversal)
**Severity**: High — CVSS 7.5
**Package**: `chainguard.dev/apko` (Go module) | **Repository**: https://github.com/chainguard-dev/apko

### Impact

apko's package install path uses `dirFS`, which **follows symlinks**.

A crafted `.apk` package can install a `TypeSymlink` tar entry whose target
points *outside the build root*. A later directory-creation or file-write tar
entry then resolves *through* that planted symlink, so the write lands outside
the build root.

An attacker who controls the contents of an `.apk` package that apko installs
can therefore write files outside the intended build root directory during
`apk install`.

### Affected / fixed versions

Affected: `chainguard.dev/apko` `0.14.8` to `< 1.2.5`.
Fixed: **`1.2.5`**.

Reproduce on a vulnerable build (**`1.2.4`**) and verify the fix on
**`1.2.5`**.

### Where to look

The fix ships in commit
[`f5a96e1299ac81c7ea9441705ec467688086f442`](https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442).
Inspect the patch to confirm the root cause and the guard:

```bash
git clone https://github.com/chainguard-dev/apko.git
cd apko && git show f5a96e1299ac81c7ea9441705ec467688086f442
```

The change makes the package install path reject the symlink-following
traversal so a later tar entry can no longer resolve through a planted symlink
and escape the build root.

### Reproduction approach

No external network, database, or browser is required — the difference is
observable as a file written outside the build root on the local filesystem.

1. Build a Go test or program depending on the `chainguard.dev/apko` module,
   pinned to the **vulnerable** `v1.2.4`.
2. Craft an `.apk` package containing a `TypeSymlink` tar entry whose target
   points outside the build root, followed by a directory-creation or
   file-write entry whose path resolves through that planted symlink.
3. Run the crafted `.apk` through apko's package install path and inspect the
   filesystem for files written outside the build root.
4. Repeat with the **fixed** build: `chainguard.dev/apko v1.2.5`.

### Expected result

| Build | Install of the crafted `.apk` (symlink entry + write through it) | Observable |
|-------|-------------------------------------------------------------------|------------|
| `chainguard.dev/apko v1.2.4` (vulnerable) | `dirFS` follows the planted symlink | **file written outside the build root** |
| `chainguard.dev/apko v1.2.5` (fixed) | traversal rejected | nothing written outside the build root; install errors/skips |

- **Vulnerable indicator**: after install, a file appears on the filesystem at a
  path outside the intended build root directory.
- **Fixed indicator**: the package install path rejects the traversal; the
  write through the planted symlink is blocked and no file is created outside
  the build root.

### Expected artifacts

- `reproduction_steps.sh` — builds the Go program against each apko module
  version, constructs the crafted `.apk` fixture, and runs the install path.
- `validation_verdict.json` — `verdict: confirmed`, with the vulnerable and
  fixed indicators captured.
- Logs capturing the install output and the filesystem state for `1.2.4` and
  `1.2.5`.