—
GO-2026-5589
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko
Quick fix
GO-2026-5589 — chainguard.dev/apko: upgrade to the fixed version with the command below.
go get chainguard.dev/apko@v1.2.5Details
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-42574[ADVISORY]
- https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442[WEB]
- https://github.com/chainguard-dev/apko/pull/2187[WEB]
- https://github.com/chainguard-dev/apko/releases/tag/v1.2.5[WEB]