CVE-2026-25145
MEDIUM5.5EPSS 0.00%melange has a path traversal in license-path which allows reading files outside workspace
描述
An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The `LicensingInfos` function in `pkg/config/config.go` reads license files specified in `copyright[].license-path` without validating that paths remain within the workspace directory, allowing path traversal via `../` sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. Fix: Merged in commit 2f95c9f4 Acknowledgements melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
受影響套件(2)
- Go/chainguard.dev/melange>= 0.14.0, < 0.40.3
- Go/chainguard.dev/melange>= 0.14.0, < 0.40.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |