{"schema_version":"1.7.3","id":"GHSA-2w4f-9fgg-q2v9","published":"2026-02-04T00:09:57Z","modified":"2026-02-05T10:25:59.451228Z","aliases":["CVE-2026-25145","GO-2026-4409"],"related":["CGA-jjh7-p782-2x93"],"summary":"melange has a path traversal in license-path which allows reading files outside workspace ","details":"An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The `LicensingInfos` function in `pkg/config/config.go` reads license files specified in `copyright[].license-path` without validating that paths remain within the workspace directory, allowing path traversal via `../` sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts.                                                                                                                                                                      \n                                                                                                                                                                                        \n  Fix: Merged in commit 2f95c9f4\n                                                                                                                                                                                        \n  Acknowledgements                                                                                                                                                                      \n                                                                                                                                                                                        \nmelange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.","affected":[{"package":{"name":"chainguard.dev/melange","ecosystem":"Go","purl":"pkg:golang/chainguard.dev/melange"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.14.0"},{"fixed":"0.40.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-2w4f-9fgg-q2v9/GHSA-2w4f-9fgg-q2v9.json"}}],"references":[{"type":"WEB","url":"https://github.com/chainguard-dev/melange/security/advisories/GHSA-2w4f-9fgg-q2v9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25145"},{"type":"WEB","url":"https://github.com/chainguard-dev/melange/commit/2f95c9f4355ed993f2670bf1bb82d88b0f65e9e4"},{"type":"PACKAGE","url":"https://github.com/chainguard-dev/melange"}],"database_specific":{"cwe_ids":["CWE-22"],"github_reviewed":true,"github_reviewed_at":"2026-02-04T00:09:57Z","nvd_published_at":"2026-02-04T20:16:06Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}]}