A crafted .apk archive supplied to apko can contain a type‑symlink entry whose target points outside the image build root. A subsequent directory‑creation or file‑write entry in the same or a later archive can then resolve that symlink and write data to arbitrary paths on the host system that the build user can modify. The result is the ability to create or overwrite files outside the container image, allowing a local attacker to tamper with the build environment or, if the host is compromised, to place malicious artifacts on host file systems. This demonstrates a CWE‑22 path traversal combined with a CWE‑59 cross‑device traversal weakness.

The vulnerability affects chainguard‑dev apko from version 0.14.8 up through, but not including, version 1.2.5. Earlier releases are impacted, and the patch was released in apko v1.2.5.

The CVSS score of 7.5 indicates a high‑severity local impact. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires an attacker to build a container with a specially crafted .apk file, so the attack vector is local to the build environment. An attacker with build privileges can write arbitrary files on the host, potentially compromising build integrity or enabling privilege escalation within that context.