CVE-2026-29051: Chainguard.dev/melange Path Traversal Vulnerability

LOW
Advisory Identifier: GHSA-q2pw-xx38-p64j
Share
CVSS 3.3
CWE-22
Published
Advisory Summary

CVE-2026-29051 is a LOW (CVSS 3.3) path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Chainguard.dev/melange libraries in the Go ecosystem. The issue involves melange has path traversal via .pkginfo in --persist-lint-results. Remediation is available by upgrading affected packages to version 0.43.4.

CVE-2026-29051 at a Glance

CVE Identifier CVE-2026-29051
GHSA Identifier GHSA-q2pw-xx38-p64j
Severity LOW
CVSS v3.1 Base Score 3.3
CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Product Chainguard.dev/melange
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 3.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2026-29051

To remediate this vulnerability, upgrade all affected Chainguard.dev/melange dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

chainguard.dev/melange fixed: 0.43.4 
Upgrade chainguard.dev/melange to 0.43.4
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for chainguard.dev/melange

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-29051, inspect your project dependencies for Chainguard.dev/melange:

inspect dependencies for chainguard.dev/melange

Analyze the terminal output to locate any version of Chainguard.dev/melange in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.43.4), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Chainguard.dev/melange, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) constructs output file paths by joining `--out-dir` with the `arch` and `pkgname` values read from the `.PKGINFO` control file of the APK being linted. In affected versions these values were not validated for path separators or `..` sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write `lint-<pkgname>-<pkgver>-r<epoch>.json` to an arbitrary `.json` path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass `--persist-lint-results`; the flag is off by default. ### Patches Fixed in melange **v0.43.4** by validating `arch` and `pkgname` for `..`, `/`, and `filepath.Separator` before path construction in `pkg/linter/results.go` (commit [84f3b45](https://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac)). ### Workarounds Do not pass `--persist-lint-results` when linting or building APKs whose `.PKGINFO` contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact. ### Credits melange thanks Oleh Konko ([@1seal](https://github.com/1seal) from [1seal.org](https://1seal.org/)) for discovering and reporting this issue.

CVE-2026-29051 Affected Chainguard.dev/melange Versions

1 component(s)
Fixed Versions:
0.43.4
Product / Package Ecosystem Affected Versions Fixed Version
chainguard.dev/melange
golang/chainguard.dev/melange
Go
≥ 0.32.0
< 0.43.4
0.43.4

References

GitHub Advisory / Wiki ADVISORY
https://github.com/chainguard-dev/melange/security/advisories/GHSA-q2pw-xx38-p64j
NVD — CVE-2026-29051 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29051
Security Fix Commit FIX COMMIT
https://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac
Chainguard.dev/melange Source Repository REPOSITORY
https://github.com/chainguard-dev/melange

Frequently Asked Questions

What is CVE-2026-29051?
CVE-2026-29051 is a security vulnerability in Chainguard.dev/melange involving melange has Path Traversal via .PKGINFO in --persist-lint-results under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
Which Chainguard.dev/melange versions are affected?
Affected versions include releases prior to 0.43.4 across affected packages: chainguard.dev/melange.
What version fixes CVE-2026-29051?
Upgrading to 0.43.4 (or the latest patched release for your respective branch) resolves the vulnerability.
Is chainguard.dev/melange affected?
Yes, chainguard.dev/melange is affected in releases prior to 0.43.4. Upgrade your dependency to 0.43.4 or later.
What is the CVSS score of CVE-2026-29051?
CVE-2026-29051 has a CVSS v3.1 base score of 3.3 (LOW) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
What CWE is associated with CVE-2026-29051?
CVE-2026-29051 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).
How can I check Go dependencies for CVE-2026-29051?
Run the dependency tree command: 'inspect dependencies for chainguard.dev/melange'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q2pw-xx38-p64j",
  "modified" : "2026-04-27T16:35:07Z",
  "published" : "2026-04-23T21:54:10Z",
  "aliases" : [ "CVE-2026-29051" ],
  "summary" : "melange has Path Traversal via .PKGINFO in --persist-lint-results",
  "details" : "### Impact\n\n`melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) constructs output file paths by joining `--out-dir` with the `arch` and `pkgname` values read from the `.PKGINFO` control file of the APK being linted. In affected versions these values were not validated for path separators or `..` sequences, so an attacker who can supply an APK to a melange-based lint/build pipeline (e.g. CI that lints third-party APKs, or build-as-a-service) could cause melange to write `lint-<pkgname>-<pkgver>-r<epoch>.json` to an arbitrary `.json` path reachable by the melange process. The written file is a JSON lint report whose content is partially attacker-influenced. There is no direct code-execution path, but the write can clobber other JSON artifacts on the filesystem. The issue only affects deployments that explicitly pass `--persist-lint-results`; the flag is off by default.\n\n### Patches\n\nFixed in melange **v0.43.4** by validating `arch` and `pkgname` for `..`, `/`, and `filepath.Separator` before path construction in `pkg/linter/results.go` (commit [84f3b45](https://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac)).\n\n### Workarounds\n\nDo not pass `--persist-lint-results` when linting or building APKs whose `.PKGINFO` contents are not fully trusted. Running melange as a low-privileged user and confining writes to an isolated directory also limits impact.\n\n### Credits\n\nmelange thanks Oleh Konko ([@1seal](https://github.com/1seal) from [1seal.org](https://1seal.org/)) for discovering and reporting this issue.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "chainguard.dev/melange"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.32.0"
      }, {
        "fixed" : "0.43.4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/chainguard-dev/melange/security/advisories/GHSA-q2pw-xx38-p64j"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-29051"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/chainguard-dev/melange"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-23T21:54:10Z",
    "nvd_published_at" : "2026-04-24T00:16:27Z"
  }
}