High severity7.0OSV Advisory· Published Jul 18, 2025· Updated Apr 15, 2026
CVE-2025-53945
CVE-2025-53945
Description
apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
chainguard.dev/apkoGo | >= 0.27.0, < 0.29.5 | 0.29.5 |
Affected products
36- Range: 0.27.8, v0.1, v0.1.1, …
- osv-coords35 versionspkg:apk/chainguard/cgpkg:apk/chainguard/chainctlpkg:apk/chainguard/docker-credential-cgrpkg:apk/chainguard/gem-checkpkg:apk/chainguard/goshpkg:apk/chainguard/header-checkpkg:apk/chainguard/help-checkpkg:apk/chainguard/ldd-checkpkg:apk/chainguard/no-docs-checkpkg:apk/chainguard/package-type-checkpkg:apk/chainguard/symlink-checkpkg:apk/chainguard/syspeekpkg:apk/chainguard/twpkg:apk/chainguard/tw-pip-checkpkg:apk/chainguard/twtpkg:apk/chainguard/usrmerge-toolpkg:apk/chainguard/ver-checkpkg:apk/chainguard/verify-servicepkg:apk/wolfi/gem-checkpkg:apk/wolfi/goshpkg:apk/wolfi/header-checkpkg:apk/wolfi/help-checkpkg:apk/wolfi/ldd-checkpkg:apk/wolfi/no-docs-checkpkg:apk/wolfi/package-type-checkpkg:apk/wolfi/symlink-checkpkg:apk/wolfi/syspeekpkg:apk/wolfi/twpkg:apk/wolfi/tw-pip-checkpkg:apk/wolfi/twtpkg:apk/wolfi/usrmerge-toolpkg:apk/wolfi/ver-checkpkg:apk/wolfi/verify-servicepkg:golang/chainguard.dev/apkopkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
< 0_git20250730-r0+ 34 more
- (no CPE)range: < 0_git20250730-r0
- (no CPE)range: < 0.2.107-r0
- (no CPE)range: < 0.2.107-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: < 0.0.19-r0
- (no CPE)range: >= 0.27.0, < 0.29.5
- (no CPE)range: < 0.0.20250730T213748-1.1
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-x6ph-r535-3vjwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-53945ghsaADVISORY
- github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9nvdWEB
- github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3nvdWEB
- github.com/chainguard-dev/apko/releases/tag/v0.29.5nvdWEB
- github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjwnvdWEB
- github.com/chainguard-dev/apko/releases/tag/v0.27.0nvd
News mentions
0No linked articles in our index yet.