{"cve":"CVE-2025-53945","nvd":{"published":"2025-07-18T16:15:30.020","modified":"2026-06-17T09:39:10.453","status":"Deferred","description":"apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","score":7.0},"cwes":["CWE-276"],"references":["https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9","https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3","https://github.com/chainguard-dev/apko/releases/tag/v0.27.0","https://github.com/chainguard-dev/apko/releases/tag/v0.29.5","https://github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjw"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:05:46.678065081+00:00"},"epss":{"cve":"CVE-2025-53945","score":0.00143,"percentile":0.03555,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-x6ph-r535-3vjw","url":"https://osv.dev/vulnerability/GHSA-x6ph-r535-3vjw","summary":"apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files","modified":"2026-09-10T03:50:57.949638450Z","packages":[{"ecosystem":"Go","name":"chainguard.dev/apko","purl":"pkg:golang/chainguard.dev/apko","ranges":[">=0.27.0 <0.29.5"],"fixed":["0.29.5"]}]},{"id":"GO-2025-3816","url":"https://osv.dev/vulnerability/GO-2025-3816","summary":"apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko","modified":"2026-02-04T04:41:04.119918Z","packages":[{"ecosystem":"Go","name":"chainguard.dev/apko","purl":"pkg:golang/chainguard.dev/apko","ranges":[">=0.27.0 <0.29.5"],"fixed":["0.29.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}