CVE-2026-25145: Melange Path Traversal Vulnerability

CVE-2026-25145 Overview

CVE-2026-25145 is a Path Traversal vulnerability affecting Melange, an open-source tool that allows users to build apk packages using declarative pipelines. The vulnerability exists in the LicensingInfos function within pkg/config/config.go, which reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory. This allows attackers to use ../ sequences to traverse outside the intended directory and read arbitrary files from the host system.

An attacker who can influence a melange configuration file—such as through pull request-driven CI workflows or build-as-a-service scenarios—could exploit this vulnerability to exfiltrate sensitive data. The contents of traversed files are embedded into the generated SBOM (Software Bill of Materials) as license text, effectively using build artifacts as a data exfiltration channel.

Critical Impact

Attackers can read arbitrary files from the host system and exfiltrate sensitive data through build artifacts by manipulating melange configuration files.

Affected Products

• Melange versions 0.14.0 to before 0.40.3

Discovery Timeline

• 2026-02-04 - CVE-2026-25145 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25145

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The core issue stems from insufficient input validation when processing license file paths specified in melange configuration files.

When melange processes a build configuration, it reads license files to include their contents in the generated SBOM. The LicensingInfos function accepts file paths from the copyright[].license-path configuration parameter without performing any validation to ensure the specified path remains within the workspace directory boundary. This oversight allows an attacker to craft a malicious configuration file containing path traversal sequences that escape the intended directory.

The attack is particularly dangerous in CI/CD environments where untrusted code contributions (such as pull requests) can modify build configuration files. Since the exfiltrated data is embedded in the SBOM output, an attacker could retrieve sensitive files like /etc/passwd, SSH keys, environment files containing secrets, or other confidential data simply by examining the build artifacts.

Root Cause

The root cause is missing path validation in the LicensingInfos function located in pkg/config/config.go. The function reads license files from paths specified in the configuration without sanitizing or validating that the resolved path stays within the workspace directory. This allows relative path sequences like ../ to traverse up the directory tree and access files outside the intended scope.

Attack Vector

The attack requires local access and user interaction—an attacker must be able to influence a melange configuration file that is subsequently processed by the build system. This commonly occurs in:

1. Pull request-driven CI pipelines: An attacker submits a PR containing a malicious melange configuration with path traversal sequences
2. Build-as-a-service platforms: Untrusted users provide configuration files to a shared build service
3. Supply chain attacks: Compromised dependencies include malicious build configurations

When the build runs, the path traversal payload causes sensitive files to be read and their contents embedded in the SBOM output. The attacker then retrieves the build artifacts to extract the exfiltrated data.

For example, a malicious copyright[].license-path value like ../../../etc/passwd would cause the build to read the system password file and embed its contents as "license text" in the generated SBOM.

Detection Methods for CVE-2026-25145

Indicators of Compromise

• Melange configuration files containing ../ sequences in copyright[].license-path values
• SBOM outputs containing unexpected content that resembles system files rather than license text
• Build logs showing file access to paths outside the workspace directory
• Unusual patterns in configuration file changes, especially from external contributors

Detection Strategies

• Implement static analysis scanning on configuration files to detect path traversal patterns before build execution
• Monitor build artifact SBOMs for anomalous content sizes or patterns inconsistent with legitimate license files
• Use file integrity monitoring on build systems to detect access to sensitive files outside workspace directories
• Review pull requests and configuration changes for suspicious path references

Monitoring Recommendations

• Enable detailed audit logging on build systems to track file access operations
• Implement alerts for file reads outside designated workspace directories during build processes
• Monitor for configuration changes that modify license-path values, especially those containing relative path components
• Track SBOM file sizes and content patterns to identify potential data exfiltration attempts

How to Mitigate CVE-2026-25145

Immediate Actions Required

• Upgrade melange to version 0.40.3 or later immediately
• Audit existing melange configuration files for any suspicious path traversal sequences in copyright[].license-path values
• Review recent build artifacts and SBOMs for signs of data exfiltration
• Restrict who can modify melange configuration files in CI/CD pipelines

Patch Information

The vulnerability has been patched in melange version 0.40.3. The fix implements proper path validation to ensure that license file paths cannot traverse outside the workspace directory. Organizations should upgrade to this version or later to remediate the vulnerability.

For detailed information about the patch, see the GitHub Commit and the GitHub Security Advisory GHSA-2w4f-9fgg-q2v9.

Workarounds

• Implement pre-build validation scripts that scan configuration files and reject any containing ../ or other path traversal sequences
• Run melange builds in isolated containers with minimal file system access to limit exposure
• Use read-only bind mounts for sensitive directories to prevent access even if path traversal is attempted
• Restrict build system permissions to prevent access to sensitive files outside the workspace

# Example: Pre-build configuration validation
# Check for path traversal attempts in melange config before building
grep -r "\.\.\/" melange.yaml && echo "ERROR: Path traversal detected" && exit 1