ByteOS Network

NVD Vulnerability Details :

CVE-2025-53945

Awaiting Analysis

Source-security-advisories@github.com

Published At-18 Jul, 2025 | 16:15

Updated At-22 Jul, 2025 | 13:06

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.0	HIGH	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Type: Secondary

Version: 3.1

Base score: 7.0

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Weaknesses

CWE ID	Type	Source
CWE-276	Primary	security-advisories@github.com

CWE ID: CWE-276

Type: Primary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9	security-advisories@github.com	N/A
https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3	security-advisories@github.com	N/A
https://github.com/chainguard-dev/apko/releases/tag/v0.27.0	security-advisories@github.com	N/A
https://github.com/chainguard-dev/apko/releases/tag/v0.29.5	security-advisories@github.com	N/A
https://github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjw	security-advisories@github.com	N/A