The vulnerability in apko (versions >= 0.14.8 and < 1.2.5) involves improper limitation of pathname to a restricted directory (CWE-22) combined with symlink handling issues (CWE-59). A maliciously crafted .apk package can include a TypeSymlink tar entry targeting a location outside the intended build root. Subsequent directory or file creation entries in the archive can then traverse this symlink, allowing writes to arbitrary paths on the host filesystem that the build user can access. This can result in unauthorized modification of host files during the container image build process. The vulnerability has been addressed and patched in apko version 1.2.5.

Successful exploitation allows an attacker to write files to arbitrary locations on the host system where the build user has write permissions. This can lead to unauthorized file modifications, potentially compromising the build environment or host integrity. The CVSS v3.1 score is 7.5 (high), reflecting network attack vector, no required privileges or user interaction, and impact limited to integrity without confidentiality or availability impact. No known exploits are reported in the wild.

Upgrade apko to version 1.2.5 or later, where this path traversal vulnerability has been patched. Since this is a software vulnerability in a non-cloud service, applying the official fix is required to remediate the issue. Patch status is confirmed by the vendor's versioning information. No additional mitigations are indicated by the vendor advisory.