PT-2026-6349 · Go · Chainguard.Dev/Melange

Published 2026-02-04 · Updated 2026-02-04

OSV

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts.

Fix: Merged in commit 2f95c9f4

Acknowledgements

melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

GHSA-2W4F-9FGG-Q2V9

Affected Products

Chainguard.Dev/Melange

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-25145 · Security Note
• https://osv.dev/vulnerability/GHSA-2w4f-9fgg-q2v9 · Vendor Advisory
• https://github.com/chainguard-dev/melange · Note
• https://github.com/chainguard-dev/melange/commit/2f95c9f4355ed993f2670bf1bb82d88b0f65e9e4 · Note
• https://github.com/chainguard-dev/melange/security/advisories/GHSA-2w4f-9fgg-q2v9 · Note