CVE-2026-29051 melange has Path Traversal via .PKGINFO in --persist-lint-results
Attackers can write arbitrary JSON files via path traversal in melange when using the opt-in persist-lint-results flag, potentially clobbering other artifacts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-29051?
CVE-2026-29051 is a medium-severity path traversal vulnerability in chainguard-dev melange, published on 24 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) constructs output file paths by joining `--out-dir` with the `arch` and `pkgname` values read from the `.PKGINFO` control file of the APK being linted. In affected versions these values were not validated for path separators or `..` sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write `lint-<pkgname>-<pkgver>-r<epoch>.json` to an arbitrary `.json` path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass `--persist-lint-results`; the flag is off by default. The issue is fixed in melange v0.43.4 by validating `arch` and `pkgname` for `..`, `/`, and `filepath.Separator` before path construction in `pkg/linter/results.go` (commit 84f3b45). As a workaround, do not pass `--persist-lint-results` when linting or building APKs whose `.PKGINFO` contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact.
Weakness: CWE-22
Which versions are affected by CVE-2026-29051?
3 open source packages ship an affected version, including chainguard.dev/melange. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
chainguard.dev/melange Go | From 0.32.0 | 0.43.4 |
chainguard.dev/melange Go | From 0.32.0 | 0.43.4 |
chainguard.dev/melange Go | From 0.32.0 | 0.43.4 |
Products include Chainguard Melange.
How do I fix CVE-2026-29051?
Upgrade chainguard.dev/melange to 0.43.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-29051 being exploited?
There is no known exploitation of CVE-2026-29051 in the wild and no public exploit code.
Other vulnerabilities in chainguard-dev melange
- CVE-2026-24843 melange QEMU runner could write files outside workspace directory
- CVE-2026-24844 melange pipeline working-directory could allow command injection
- CVE-2026-25143 melange affected by potential host command execution via license-check YAML mode patch pipeline
- CVE-2026-29050 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses
- CVE-2026-25145 melange has a path traversal in license-path which allows reading files outside workspace
Sources
Also known as GHSA-q2pw-xx38-p64j, GO-2026-5562.