melange has a path traversal in license-path which allows reading files outside workspace

CVE-2026-25145 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts.

Fix: Merged in commit 2f95c9f4

Acknowledgements

melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2026-02-04 00:09:57 UTC
Updated
2026-02-04 21:56:16 UTC
GitHub reviewed
2026-02-04 00:09:57 UTC
NVD published
2026-02-04

EPSS Score

Score Percentile
0.00% 0.15%

CVSS Scores

Base score Version Severity Vector
5.5 3.1 —
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.

Identifiers

Type Value
GHSA GHSA-2w4f-9fgg-q2v9 ↗
CVE CVE-2026-25145 ↗

CWEs

CWE id Name
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Credits

  • 1seal (reporter)
  • sil2100 (remediation_developer)
  • antitree (coordinator)
  • egibs (coordinator)
  • eslerm (coordinator)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
go chainguard.dev/melange >= 0.14.0, < 0.40.3 0.40.3 —

References

cvelogic Threat Intelligence