GO-2026-5589
- Source
- https://pkg.go.dev/vuln/GO-2026-5589
- Import Source
- https://vuln.go.dev/ID/GO-2026-5589.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-5589
- Aliases
-
- CVE-2026-42574
- GHSA-qq3r-w4hj-gjp6
- Published
- 2026-06-25T22:34:34Z
- Modified
- 2026-06-25T23:01:32.637445332Z
- Summary
- apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko
- Details
-
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko
- Database specific
{ "url": "https://pkg.go.dev/vuln/GO-2026-5589", "review_status": "UNREVIEWED" }- References
-
- https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6
- https://nvd.nist.gov/vuln/detail/CVE-2026-42574
- https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442
- https://github.com/chainguard-dev/apko/pull/2187
- https://github.com/chainguard-dev/apko/releases/tag/v1.2.5
Affected packages
Go / chainguard.dev/apko
Package
- Name
- chainguard.dev/apko
- View open source insights on deps.dev
- Purl
- pkg:golang/chainguard.dev/apko