CVE-2026-25145: 
NixOS vulnerability analysis and mitigation

CVE-2026-25145 is a path traversal vulnerability in Chainguard's melange, a tool for building APK packages using declarative pipelines. The flaw exists in the LicensingInfos function within pkg/config/config.go, where copyright[].license-path values are read without validating that paths remain within the workspace directory, enabling arbitrary file reads via ../ sequences. Affected versions span from v0.14.0 through v0.40.4, with the fix available in v0.40.5. It was disclosed on February 3, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Github Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In the vulnerable code path, os.ReadFile(filepath.Join(workspaceDir, cp.LicensePath)) is called without sanitizing cp.LicensePath, allowing an attacker to supply values such as ../sensitive/secrets.txt or absolute paths like /etc/passwd that resolve outside the intended workspace directory. The fix (commit 2f95c9f4) introduces filepath.Clean and filepath.Localize to normalize and restrict the path before joining it with the workspace directory, rejecting any path that escapes the workspace (GitHub Commit, GitHub Advisory). Exploitation requires the ability to influence a melange configuration file, which is realistic in pull request-driven CI pipelines or build-as-a-service environments where untrusted contributors can submit configuration changes.

Successful exploitation allows an attacker to read arbitrary files from the host build system — including credentials, environment files, SSH keys, or other sensitive configuration — by embedding their contents into the generated Software Bill of Materials (SBOM) as license text. The exfiltrated data is then retrievable through the build artifact (SBOM), which may be published or shared as part of the software supply chain. There is no integrity or availability impact; the vulnerability is limited to high confidentiality impact on the build host (Github Advisory, GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.012% (0th percentile), indicating a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to scenarios where an attacker can modify or submit a melange configuration file, such as through open pull requests in CI pipelines or build-as-a-service platforms (Github Advisory, GitHub Advisory).

1. Identify a target: Find a project using melange v0.14.0–v0.40.4 in a CI/CD pipeline that processes pull requests or accepts external build configurations.
2. Craft a malicious configuration: Modify or submit a melange YAML configuration file with a copyright[].license-path value containing a path traversal sequence, for example:

copyright:
  - license: MIT
    license-path: "../../../etc/passwd"

3. Trigger a build: Submit the configuration via a pull request or build request so that the melange build process is executed on the host system.
4. Retrieve the exfiltrated data: After the build completes, inspect the generated SBOM artifact. The contents of the traversed file (e.g., /etc/passwd or a credentials file) will be embedded as license text within the SBOM, which can then be downloaded or accessed through the build artifact store (GitHub Advisory, Github Advisory).

• File System: Generated SBOM files containing unexpected or non-license text content in license fields (e.g., contents resembling /etc/passwd, environment variable files, or credential files).
• Logs: Build system logs showing melange processing configuration files with license-path values containing ../ sequences or absolute paths (e.g., /etc/, /root/, /home/).
• Configuration Artifacts: Melange YAML configuration files in pull requests or build inputs with copyright[].license-path fields referencing paths outside the workspace directory, including patterns like ../../, ../, or absolute paths starting with /.

Upgrade melange to version 0.40.5 or later, which contains the fix merged in commit 2f95c9f4 that validates license-path values using filepath.Clean and filepath.Localize to prevent traversal outside the workspace directory (GitHub Advisory, GitHub Commit). As a workaround prior to patching, restrict who can submit or modify melange configuration files in CI/CD pipelines, and require review of all copyright[].license-path fields in incoming pull requests. Additionally, review any SBOMs generated by vulnerable versions for signs of unexpected file content embedded as license text.

The vulnerability was discovered and reported by Oleh Konko (@1seal) from 1seal, and was acknowledged by the Chainguard melange maintainers in the security advisory. The fix was coordinated by multiple contributors including antitree (remediation developer) and coordinators egibs and eslerm (GitHub Advisory). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database entries.