CVE-2026-25145: melange has a path traversal in license-path which allows reading files outside workspace
An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. Fix: Merged in commit 2f95c9f4 Acknowledgements melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
Other sources
melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. This issue has been patched in version 0.40.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25145?
CVE-2026-25145 has been classified as a high severity vulnerability.
How does CVE-2026-25145 affect vulnerable systems?
CVE-2026-25145 allows attackers to read arbitrary files from the host system if they can influence the melange configuration file.
What versions of melange are affected by CVE-2026-25145?
CVE-2026-25145 affects melange versions between 0.14.0 and 0.40.3, excluding 0.40.3.
How do I fix CVE-2026-25145?
To remediate CVE-2026-25145, you should upgrade to the latest version of melange that is beyond 0.40.3.
Can CVE-2026-25145 be exploited remotely?
Yes, CVE-2026-25145 can potentially be exploited remotely through malicious pull requests or build scenarios.