EUVD-2026-25356
GHSA-q2pw-xx38-p64j
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Local attack vector because exploitation occurs on the melange host; no confidentiality impact; integrity and availability each low due to JSON-only clobber without code execution.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
Impact
melange lint --persist-lint-results (opt-in flag, also usable via melange build --persist-lint-results) constructs output file paths by joining --out-dir with the arch and pkgname values read from the .PKGINFO control file of the APK being linted. In affected versions these values were not validated for path separators or .. sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write lint-<pkgname>-<pkgver>-r<epoch>.json to an arbitrary .json path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass --persist-lint-results; the flag is off by default.
Patches
Fixed in melange v0.43.4 by validating arch and pkgname for .., /, and filepath.Separator before path construction in pkg/linter/results.go (commit 84f3b45).
Workarounds
Do not pass --persist-lint-results when linting or building APKs whose .PKGINFO contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact.
Credits
melange thanks Oleh Konko (@1seal from 1seal.org) for discovering and reporting this issue.
AnalysisAI
Path traversal in Chainguard melange's --persist-lint-results feature allows an attacker who controls the contents of a processed APK to write attacker-influenced JSON files to arbitrary filesystem locations reachable by the melange process. Affected versions span v0.32.0 through v0.43.3; the root cause is that arch and pkgname values from the APK's .PKGINFO control file were used unsanitized in output path construction. No direct code execution is possible, but the write primitive can clobber other JSON artifacts on the build host. No public exploit code exists and CISA KEV does not list this vulnerability.
Technical ContextAI
melange (pkg:go/chainguard.dev/melange) is a Chainguard-maintained Go tool for building Alpine-compatible APK packages and running lint checks on them. The vulnerable code path is in pkg/linter/results.go: when --persist-lint-results is passed, melange calls saveLintResults, which constructs the output file path by joining --out-dir with the arch and pkgname fields extracted from the APK's .PKGINFO control file without validating those fields for .. sequences, /, or filepath.Separator. This is a textbook CWE-22 (Path Traversal) pattern - unsanitized attacker-controlled data used in a filesystem path join. The fix (commit 84f3b45, melange v0.43.4) adds a containsPathTraversal helper that rejects any arch or pkgname containing .., /, or the platform's filepath.Separator before the path is assembled.
RemediationAI
Upgrade to melange v0.43.4 or later, which validates arch and pkgname against path traversal sequences before file path construction (https://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac). If an immediate upgrade is not possible, the primary workaround is to remove the --persist-lint-results flag from all melange lint and melange build invocations - this eliminates the vulnerable code path entirely with no functional loss for pipelines that do not consume the JSON lint output. As an additional defense-in-depth measure, run melange as a low-privileged user account so that even if path traversal is exploited, the clobber radius is limited to files writable by that user. Confining the melange process to an isolated working directory (e.g., via a container or chroot) further restricts which JSON files could be overwritten. Do not lint APKs with untrusted .PKGINFO contents until the patch is applied.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today