CVE-2026-25145
melange has a path traversal in license-path which allows reading files outside workspace
Impact
An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The `LicensingInfos` function in `pkg/config/config.go` reads license files specified in `copyright[].license-path` without validating that paths remain within the workspace directory, allowing path traversal via `../` sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. Fix: Merged in commit 2f95c9f4 Acknowledgements melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | chainguard.dev/melange | >= 0.14.0, < 0.40.3 | 0.40.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Chainguard | Melange | from 0.14.0 before 0.40.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/chainguard-dev/melange/commit/2f95c9f4355ed993f2670bf1bb82d88b0f65e9e4
- https://github.com/chainguard-dev/melange/security/advisories/GHSA-2w4f-9fgg-q2v9
- https://github.com/advisories/GHSA-2w4f-9fgg-q2v9
- https://nvd.nist.gov/vuln/detail/CVE-2026-25145