High
melange QEMU runner could write files outside workspace directory
Type: advisorySources: OSV
melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-24843
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 04:36 UTC · Revision 1
Source evidence
melange QEMU runner could write files outside workspace directory
core-osv · Original sourcePublished 4 Feb 2026, 19:31 UTC
melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.
osv:CVE-2026-24843
Complete source record
{
"id": "048a75d5e99bd8250cfa9da71c6587102b9fb487d22a35426ad75f010e043050",
"url": "https://osv.dev/vulnerability/CVE-2026-24843",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "melange QEMU runner could write files outside workspace directory",
"summary": "melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.",
"evidence": "osv:CVE-2026-24843",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-24843",
"aliases": [
"CVE-2026-24843",
"GHSA-qxx2-7h4c-83f4",
"GO-2026-4407"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/chainguard-dev/melange",
"type": "GIT",
"events": [
{
"introduced": "4ecc73b9b01f3a4f996836ccbc10dcac60ea3014"
},
{
"fixed": "0f2f34dda06a67ca7b5952fe3f1f66edddfe17f1"
},
{
"fixed": "6e243d0d46699f837d7c392397a694d2bcc7612b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:*",
"range": [
{
"introduced": "0.11.3"
},
{
"fixed": "0.40.5"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "6e243d0d46699f837d7c392397a694d2bcc7612b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v0.40.2",
"v0.40.1",
"v0.40.0",
"v0.39.0",
"v0.38.1",
"v0.38.0",
"v0.37.5",
"v0.37.4",
"v0.37.3",
"v0.37.2",
"v0.37.1",
"v0.37.0",
"v0.36.0",
"v0.35.1",
"v0.35.0",
"v0.34.3",
"v0.34.2",
"v0.34.1",
"v0.34.0",
"v0.33.2",
"v0.33.1",
"v0.33.0",
"v0.32.0",
"v0.31.9",
"v0.31.8",
"v0.31.7",
"v0.31.6",
"v0.31.5",
"v0.31.4",
"v0.31.3",
"v0.31.2",
"v0.31.1",
"v0.31.0",
"v0.30.6",
"v0.30.5",
"v0.30.4",
"v0.30.3",
"v0.30.2",
"v0.30.1",
"v0.30.0",
"v0.29.7",
"v0.29.6",
"v0.29.5",
"v0.29.4",
"v0.29.3",
"v0.29.2",
"v0.29.1",
"v0.29.0",
"v0.28.0",
"v0.27.0",
"v0.26.13",
"v0.26.12",
"v0.26.11",
"v0.26.10",
"v0.26.9",
"v0.26.8",
"v0.26.7",
"v0.26.6",
"v0.26.5",
"v0.26.4",
"v0.26.3",
"v0.26.2",
"v0.26.1",
"v0.26.0",
"v0.25.1",
"v0.25.0",
"v0.24.0",
"v0.23.17",
"v0.23.16",
"v0.23.15",
"v0.23.14",
"v0.23.13",
"v0.23.12",
"v0.23.11",
"v0.23.10",
"v0.23.9",
"v0.23.8",
"v0.23.7",
"v0.23.6",
"v0.23.5",
"v0.23.4",
"v0.23.3",
"v0.23.2",
"v0.23.1",
"v0.23.0",
"v0.22.2",
"v0.22.1",
"v0.22.0",
"v0.21.2",
"v0.21.1",
"v0.21.0",
"v0.20.1",
"v0.20.0",
"v0.19.5",
"v0.19.4",
"v0.19.3",
"v0.19.1",
"v0.19.2",
"v0.19.0",
"v0.18.3",
"v0.18.2",
"v0.18.1",
"v0.18.0",
"v0.17.7",
"v0.17.6",
"v0.17.5",
"v0.17.4",
"v0.17.3",
"v0.17.2",
"v0.17.1",
"v0.17.0",
"v0.16.0",
"v0.15.14",
"v0.15.13",
"v0.15.12",
"v0.15.7",
"v0.15.11",
"v0.15.10",
"v0.15.9",
"v0.15.8",
"v0.15.6",
"v0.15.5",
"v0.15.4",
"v0.14.8",
"v0.15.3",
"v0.15.2",
"v0.14.9",
"v0.15.1",
"v0.15.0",
"v0.14.11",
"v0.14.10",
"v0.14.7",
"v0.14.6",
"v0.14.5",
"v0.14.4",
"v0.14.3",
"v0.14.2",
"v0.14.1",
"v0.14.0",
"v0.13.7",
"v0.13.6",
"v0.13.5",
"v0.13.4",
"v0.13.3",
"v0.13.2",
"v0.13.1",
"v0.13.0",
"v0.12.1",
"v0.12.0",
"v0.11.6",
"v0.11.5",
"v0.11.4",
"v0.11.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24843.json"
}
}
],
"modified": "2026-10-28T02:30:33.212374251Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24843.json",
"https://github.com/chainguard-dev/melange/security/advisories/GHSA-qxx2-7h4c-83f4",
"https://nvd.nist.gov/vuln/detail/CVE-2026-24843",
"https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b"
],
"provider_metadata": {
"cwe_ids": [
"CWE-22"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24843.json"
}
},
"related_cves": [
{
"value": "CVE-2026-24843",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 500331,
"published_at": "2026-02-04T19:31:35.608+00:00"
}