Vulnerability Description
melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Chainguard | Melange | >= 0.11.3, < 0.40.5 |
Related Weaknesses (CWE)
References
- https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694dPatch
- https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83fPatchVendor Advisory
FAQ
What is CVE-2026-24843?
CVE-2026-24843 is a vulnerability with a CVSS score of 8.2 (HIGH). melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside ...
How severe is CVE-2026-24843?
CVE-2026-24843 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-24843?
Check the references section above for vendor advisories and patch information. Affected products include: Chainguard Melange.