CVE-2026-24843: Melange Path Traversal Vulnerability

CVE-2026-24843 Overview

CVE-2026-24843 is a path traversal vulnerability in melange, a tool that allows users to build apk packages using declarative pipelines. In versions 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences.

Critical Impact

This vulnerability enables arbitrary file write on the host system from a QEMU guest VM, potentially leading to host compromise, privilege escalation, or persistent backdoor installation through malicious tar stream manipulation.

Affected Products

• melange versions 0.11.3 through 0.40.2
• Systems running melange with QEMU guest VM workspace retrieval
• Build environments utilizing melange declarative pipelines

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-24843 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-24843

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The flaw exists in the retrieveWorkspace function which is responsible for extracting tar archives received from QEMU guest virtual machines. During the extraction process, the function fails to validate that file paths contained within tar entries remain within the designated workspace directory boundaries.

An attacker with control over the tar stream from a QEMU guest VM can craft malicious tar entries containing path traversal sequences such as ../ to escape the workspace directory. This allows writing arbitrary files to locations on the host filesystem outside the intended extraction directory. The attack requires local access and some user interaction, but can result in complete compromise of host system integrity and availability.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the retrieveWorkspace function. When processing tar archive entries, the function directly uses the path information provided in the tar headers without sanitizing or validating that the resolved file paths remain confined to the designated workspace directory. This allows specially crafted tar entries with relative path components (../) to traverse up the directory structure and write files to arbitrary locations on the host system.

Attack Vector

The attack requires an adversary who can influence the content of the tar stream sent from a QEMU guest VM to the host. The attacker crafts a malicious tar archive containing entries with path traversal sequences in their filenames. When the retrieveWorkspace function extracts these entries, the ../ sequences cause files to be written outside the workspace boundary.

For example, a tar entry with a path like ../../../etc/cron.d/malicious would traverse three directories up from the workspace and write a file to the system cron directory. This could enable persistent code execution, configuration tampering, or overwriting critical system files. The attack surface exists in any melange build environment where untrusted or compromised QEMU guests may provide tar streams to the host.

Detection Methods for CVE-2026-24843

Indicators of Compromise

• Unexpected files appearing outside melange workspace directories during or after build operations
• Tar extraction operations from QEMU guests that result in file writes to system directories
• Modified system files or configurations that coincide with melange build activity
• Anomalous file creation events in sensitive directories like /etc, /usr, or user home directories

Detection Strategies

• Monitor file system activity during melange build operations for writes outside designated workspace paths
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Review melange logs for tar extraction errors or unusual path resolutions
• Deploy endpoint detection rules to alert on path traversal patterns in file operations originating from build processes

Monitoring Recommendations

• Enable detailed logging for melange build operations and QEMU guest interactions
• Configure SentinelOne Singularity Platform to monitor for suspicious file write operations during container and VM build activities
• Implement alerting on file creation events that contain ../ sequences in the path
• Monitor for changes to sensitive directories that correlate with melange execution times

How to Mitigate CVE-2026-24843

Immediate Actions Required

• Upgrade melange to version 0.40.3 or later immediately
• Audit systems running affected melange versions (0.11.3 to 0.40.2) for signs of exploitation
• Review any build artifacts and host filesystems for unexpected file modifications
• Temporarily isolate build environments using affected versions until patches can be applied

Patch Information

The vulnerability has been patched in melange version 0.40.3. The fix is available in GitHub commit 6e243d0d46699f837d7c392397a694d2bcc7612b. Organizations should upgrade to version 0.40.3 or later to remediate this vulnerability. For additional details, refer to the GitHub Security Advisory GHSA-qxx2-7h4c-83f4.

Workarounds

• Restrict access to melange build environments to trusted personnel only
• Implement additional sandboxing around melange build operations to limit host filesystem access
• Run melange in a containerized environment with restricted volume mounts to minimize the impact of path traversal
• Apply strict network segmentation to isolate QEMU guest VMs from sensitive host resources