Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-53945

Good to know:

icon

Date: July 18, 2025

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.

Severity Score

Related Resources (8)

https://nvd.nist.gov/vuln/detail/CVE-2025-53945
https://github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjw
https://github.com/chainguard-dev/apko
https://github.com/chainguard-dev/apko/releases/tag/v0.29.5
https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9
https://github.com/chainguard-dev/apko/releases/tag/v0.27.0
https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3
https://www.mend.io/vulnerability-database/CVE-2025-53945

Severity Score

Weakness Type (CWE)

Incorrect Default Permissions

CWE-276

Top Fix

icon

Upgrade Version

Upgrade to version chainguard.dev/apko - v0.29.5

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us