The vulnerability in apko (versions >=0.14.8 and <1.2.5) involves improper limitation of pathname to a restricted directory (CWE-22) combined with symbolic link handling (CWE-59). A malicious .apk package can create a symlink in the tar archive that points outside the intended build root directory. Subsequent directory or file creation entries in the same or later archive can traverse this symlink, enabling writes to arbitrary paths on the host system where the build user has write permissions. This can lead to unauthorized file writes outside the build environment. The issue was patched in apko version 1.2.5.

An attacker who can supply a crafted .apk package to apko during the container image build process can cause arbitrary file writes outside the intended build root directory. This could lead to unauthorized modification of files on the host system with the privileges of the build user. There is no confidentiality impact reported, but integrity is highly impacted. Availability is not affected. No known exploits in the wild have been reported.

Upgrade apko to version 1.2.5 or later, where this path traversal vulnerability has been patched. Until the upgrade is applied, avoid building container images from untrusted .apk packages. Patch status is confirmed by the vendor advisory indicating the fix in version 1.2.5.