What is the CVSS score of CVE-2026-24843?

CVE-2026-24843 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Melange are affected by CVE-2026-24843?

CVE-2026-24843 affects melange, a container package build tool, allowing attackers to write files outside intended directories if they can compromise the QEMU build environment.. A patch is available.

How to fix or mitigate CVE-2026-24843?

Within 24 hours: Identify all systems running affected melange versions (0.11.3 to 0.40.2) and isolate build pipelines from untrusted inputs. Within 7 days: Upgrade melange to version 0.40.3 or later across all build infrastructure. Within 30 days: Conduct security audit of all packages built with vulnerable versions, validate build artifact integrity, and implement network segmentation to restrict QEMU guest VM access.

Melange CVE-2026-24843

HIGH

Path Traversal (CWE-22)

2026-02-04 security-advisories@github.com

GHSA-qxx2-7h4c-83f4

Path Traversal Melange Suse

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 18, 2026 - 15:57 nvd

Patch available

CVE Published

Feb 04, 2026 - 20:16 nvd

HIGH 8.2

DescriptionGitHub Advisory

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.

AnalysisAI

Melange versions 0.11.3 through 0.40.2 suffer from a path traversal vulnerability in the retrieveWorkspace function that fails to validate tar entry paths, allowing an attacker with control over a QEMU guest VM's tar stream to write arbitrary files outside the intended workspace directory on the host system. An attacker exploiting this vulnerability could achieve arbitrary file write capabilities on the host machine, potentially leading to system compromise. A patch is available in version 0.40.3 and later.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Melange. melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.