What is CVE-2026-42574?

CVE-2026-42574 is a high-severity vulnerability in Chainguard-Dev Apko, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-05-09.

How severe is CVE-2026-42574?

High severity. CVSS v3 base score is 7.5 out of 10.

Path Traversal in Chainguard-Dev Apko

CVE-2026-42574

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.004 (28.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Chainguard-dev Apko — versions >= 0.14.8, < 1.2.5

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-42574?: CVE-2026-42574 is a high-severity vulnerability in Chainguard-Dev Apko, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-05-09.
How severe is CVE-2026-42574?: High severity. CVSS v3 base score is 7.5 out of 10.