CVE-2026-25145

Name of the Vulnerable Software and Affected Versions melange versions 0.14.0 through 0.40.2

Description melange allows users to build apk packages using declarative pipelines. An attacker who can influence a melange configuration file could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via '../' sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts.

Recommendations Update to version 0.40.3 or later.