CVE-2026-24843
📋 TL;DR
CVE-2026-24843 is a path traversal vulnerability in melange that allows attackers to write files outside the intended workspace directory. Attackers who can influence tar streams from QEMU guest VMs can exploit this to potentially overwrite critical system files. Users running melange versions 0.11.3 through 0.40.2 for building apk packages are affected.
💻 Affected Systems
- melange
📦 What is this software?
Melange by Chainguard
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file write leading to remote code execution, privilege escalation, or data destruction.
Likely Case
Unauthorized file writes to sensitive locations, potentially disrupting system operations or enabling further attacks.
If Mitigated
Limited impact if proper sandboxing and isolation are in place, though file system integrity could still be compromised.
🎯 Exploit Status
Requires ability to influence tar streams from QEMU guest VMs, which typically requires some level of access or control over the build process.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.40.3
Vendor Advisory: https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83f4
Restart Required: No
Instructions:
1. Update melange to version 0.40.3 or later using your package manager. 2. Verify the update was successful. 3. No restart required as melange is a build tool.
🔧 Temporary Workarounds
Restrict QEMU guest access
linuxLimit who can control or influence QEMU guest VMs used by melange.
Use isolated build environments
linuxRun melange in containerized or sandboxed environments with restricted filesystem access.
🧯 If You Can't Patch
- Implement strict access controls on who can submit or modify build pipelines.
- Monitor file system writes outside workspace directories and implement integrity checking.
🔍 How to Verify
Check if Vulnerable:
Check melange version: if between 0.11.3 and 0.40.2 inclusive, you are vulnerable.Check Version:
melange versionVerify Fix Applied:
Verify melange version is 0.40.3 or later and test that path traversal attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- File writes outside workspace directories
- Path traversal patterns in tar extraction logs
- Unexpected file modifications in system directories
Network Indicators:
- Unusual network activity from build systems
- Suspicious tar stream transfers
SIEM Query:
Search for melange process writing files with '../' patterns or outside expected workspace paths.