# apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

apko's sanitizePath only blocked lexical '..' traversal, so a malicious .apk symlink entry let later MkdirAll/WriteFile calls escape the build root to host paths.

- Payout: Research
- Severity: high
- Program: apko
- Found by: 1seal, vamsik2k5
- Disclosed: 2026-05-04
- CVE: CVE-2026-42574
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-qq3r-w4hj-gjp6
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-qq3r-w4hj-gjp6
- Tags: area:oss domain:oss impact:integrity kind:research platform:ghsa sev:high tech:go technique:chained technique:incomplete-fix technique:source-review vuln:path-traversal

**Target:** Go pkg/apk/fs DirFS disk-backed filesystem during APK tar extraction
**Root cause:** sanitizePath in pkg/apk/fs/rwosfs.go rejected only lexical '..' components and never resolved or refused symlinks, so caller-supplied paths were passed to symlink-following stdlib calls.
**Steps:**
1. Craft a .apk containing a TypeSymlink tar entry whose target points outside the build root.
2. Include a subsequent directory-creation or file-write entry in the same or a later archive.
3. Run `apko build-cpio` (or a disk-backed consumer like melange) so extraction reaches DirFS.MkdirAll/Mkdir/WriteFile.
4. The write follows the planted symlink and lands on a host path writable by the build user.
**How found:** Prior advisory GHSA-5g94-c2wx-8pxw fixed lexical '..' traversal; researchers then probed whether the sanitizer handled symlinks, finding every disk-backed DirFS method forwarded paths to symlink-following stdlib calls.
**Exploitation:** A malicious APK plants a symlink escaping the build root, then a later MkdirAll/Mkdir/WriteFile entry traverses it to write outside the root; other sinks (ReadFile, Chmod, Chown, Chtimes, Mknod) are reachable by direct callers of pkg/apk/fs.
**Insight:** When a path sanitizer only strips '..', test whether an earlier archive entry can plant a symlink that a later entry follows — the fix must scope operations through an os.Root-style handle, not lexical checks.