{"id":"CVE-2025-53945","aliases":["EUVD-2025-21896","GHSA-x6ph-r535-3vjw","GO-2025-3816","openSUSE-SU-2025:15405-1"],"status":"published","title":"apko has incorrect permission (0666) in /etc/ld.so.cache and other files","description":"apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00143,"percentile":0.03635,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2025-07-18T15:35:17Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"Go","package":"chainguard.dev/apko","fixed_in":["0.29.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"chainguard.dev/apko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.0"},{"fixed":"0.29.5"}]}]},{"source":"osv","ecosystem":"Go","package":"chainguard.dev/apko","ranges":[{"type":"SEMVER","events":[{"introduced":"0.27.0"},{"fixed":"0.29.5"}]}]},{"source":"osv","ecosystem":"Go","package":"chainguard.dev/apko","ranges":[{"type":"SEMVER","events":[{"introduced":"0.27.0"},{"fixed":"0.29.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250730T213748-1.1"}]}],"bundled":56}],"products":[{"vendor":"chainguard-dev","product":"apko"}],"references":[{"url":"https://github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjw","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/chainguard-dev/apko/releases/tag/v0.27.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/chainguard-dev/apko/releases/tag/v0.29.5","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53945","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x6ph-r535-3vjw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53945.json","tags":["advisory"]},{"url":"https://github.com/chainguard-dev/apko","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-51471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6624","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-53945","title":"apko has incorrect permission (0666) in /etc/ld.so.cache and other files","description":"apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.","status":"published","published":"2025-07-18T15:35:17.325Z","modified":"2025-07-22T15:03:42.966Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:32:48.853452Z"}],"euvd":[{"id":"EUVD-2025-21896","description":"apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.","status":"published","published":"2025-07-18T15:35:17Z","modified":"2025-07-22T15:03:42Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:32:05.744165Z"}],"ghsa":[{"id":"GHSA-x6ph-r535-3vjw","title":"apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files","description":"It was discovered that the ld.so.cache in images generated by apko had file system permissions mode `0666`:\n```\nbash-5.3# find / -type f -perm -o+w\n/etc/ld.so.cache\n```\n\nThis issue was introduced in commit [04f37e2 (\"generate /etc/ld.so.cache (#1629)\")](https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9)([v0.27.0](https://github.com/chainguard-dev/apko/releases/tag/v0.27.0)).\n\n###  Impact\nThis potentially allows a local unprivileged user to add additional additional directories including dynamic libraries to the dynamic loader path. A user could exploit this by placing a malicious library in a directory they control.\n\n### Patches\nThis issue was addressed in apko in [aedb077 (\"fix: /etc/ld.so.cache file permissions (#1758)\")](https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3) ([v0.29.5](https://github.com/chainguard-dev/apko/releases/tag/v0.29.5)).\n\n### Acknowledgements\n\nMany thanks to Cody Harris from [H2O.ai](http://h2o.ai/) for reporting this issue.","status":"published","published":"2025-07-18T20:03:25Z","modified":"2025-07-18T20:03:26Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:38:50.834587Z"}],"nvd":[{"id":"CVE-2025-53945","description":"apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.","status":"published","published":"2025-07-18T16:15:30.02Z","modified":"2026-06-17T09:39:10.453Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:11:18.782156Z"}],"osv":[{"id":"CVE-2025-53945","title":"apko has incorrect permission (0666) in /etc/ld.so.cache and other files","description":"apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.","status":"published","published":"2025-07-18T15:35:17.325Z","modified":"2026-11-11T10:47:21.610397415Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"GHSA-x6ph-r535-3vjw","title":"apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files","description":"It was discovered that the ld.so.cache in images generated by apko had file system permissions mode `0666`:\n```\nbash-5.3# find / -type f -perm -o+w\n/etc/ld.so.cache\n```\n\nThis issue was introduced in commit [04f37e2 (\"generate /etc/ld.so.cache (#1629)\")](https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9)([v0.27.0](https://github.com/chainguard-dev/apko/releases/tag/v0.27.0)).\n\n###  Impact\nThis potentially allows a local unprivileged user to add additional additional directories including dynamic libraries to the dynamic loader path. A user could exploit this by placing a malicious library in a directory they control.\n\n### Patches\nThis issue was addressed in apko in [aedb077 (\"fix: /etc/ld.so.cache file permissions (#1758)\")](https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3) ([v0.29.5](https://github.com/chainguard-dev/apko/releases/tag/v0.29.5)).\n\n### Acknowledgements\n\nMany thanks to Cody Harris from [H2O.ai](http://h2o.ai/) for reporting this issue.","status":"published","published":"2025-07-18T20:03:25Z","modified":"2026-09-10T03:50:57.94963845Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"GO-2025-3816","title":"apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko","description":"apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko","status":"published","published":"2025-07-29T18:49:33Z","modified":"2026-02-04T04:41:04.119918Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15405-1","title":"govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-04T00:00:00Z","modified":"2026-03-23T04:53:44.42671Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}