CVE-2026-25145

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. This issue has been patched in version 0.40.3.

• CWE-22

• https://github.com/chainguard-dev/melange/commit/2f95c9f4355ed993f2670bf1bb82d88b0f65e9e4Patch
• https://github.com/chainguard-dev/melange/security/advisories/GHSA-2w4f-9fgg-q2v9Patch, Vendor Advisory

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2514In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3,…8.6
• CVE-2026-25140apko allows users to build and publish OCI container images …7.5
• CVE-2026-25141Orval generates type-safe JS clients (TypeScript) from any v…9.8
• CVE-2026-25142SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2…10
• CVE-2026-25143melange allows users to build apk packages using declarative…7.8
• CVE-2026-25144Talishar is a fan-made Flesh and Blood project. A Stored XSS…5.3
• CVE-2026-25146OpenEMR is a free and open source electronic health records …8.1
• CVE-2026-25147OpenEMR is a free and open source electronic health records …7.1
• CVE-2026-25148Qwik is a performance focused javascript framework. Prior to…6.1
• CVE-2026-25149Qwik is a performance focused javascript framework. Prior to…6.1
• CVE-2026-2515The Hostinger Reach – AI-Powered Email Marketing for WordPre…5.3
• CVE-2026-25150Qwik is a performance focused javascript framework. Prior to…10