{
  "cve_id": "CVE-2026-42574",
  "ghsa_id": "GHSA-qq3r-w4hj-gjp6",
  "cwe": "CWE-22",
  "vulnerable_version": "v1.2.4",
  "fixed_version": "v1.2.5",
  "vulnerability_confirmed": true,
  "fix_verified": true,
  "verdict": "CONFIRMED_AND_FIXED",
  "findings": {
    "vulnerable": {
      "file_exists_outside_build_root": true,
      "outside_file_content": "malicious-content",
      "write_error": "file does not exist",
      "description": "The vulnerable version v1.2.4 allows writing files outside the build root through a planted symlink. A symlink 'evil' pointing to '../outside' was created inside the base directory, and a subsequent WriteFile('evil/pwned') successfully wrote 'malicious-content' to the outside directory."
    },
    "fixed": {
      "file_exists_outside_build_root": false,
      "write_error": "openat evil/pwned: path escapes from parent",
      "description": "The fixed version v1.2.5 correctly rejects the path traversal attempt. Writing through the planted symlink 'evil/pwned' is blocked with an 'path escapes from parent' error, and no file is created outside the build root."
    }
  },
  "evidence": {
    "vulnerable_report": "logs/vuln_report.json",
    "fixed_report": "logs/fix_report.json",
    "runtime_manifest": "repro/runtime_manifest.json",
    "reproduction_script": "repro/reproduction_steps.sh",
    "rca_report": "repro/rca_report.md"
  },
  "timestamp": "2025-05-22T18:15:00Z",
  "reproduced_by": "reproduction_steps.sh",
  "notes": "The vulnerability is a symlink-following path traversal in apko's dirFS implementation. The fix uses os.Root to sandbox filesystem operations and prevent symlink traversal outside the build root."
}