[SECURITY] Multiple vulnerabilities detected in Docker image (libexpat, libpng, zlib)

[Kofysh]

Security Advisory

A routine security scan of the Docker image ghcr.io/vert-sh/vert:latest has identified 5 vulnerabilities across 3 packages, including one of high severity.

Vulnerabilities detected

CVE	Package	Severity	Installed	Fixed
CVE-2026-25646	libpng	High	1.6.54-r0	1.6.55-r0
CVE-2026-22184	zlib	High	1.3.1-r2	1.3.2-r0
CVE-2026-32777	libexpat	Medium	2.7.4-r0	2.7.5-r0
CVE-2026-32778	libexpat	Medium	2.7.4-r0	2.7.5-r0
CVE-2026-27171	zlib	Medium	1.3.1-r2	1.3.2-r0

Remediation

All vulnerabilities can be resolved by updating the affected packages in the base image:

• libexpat → 2.7.5-r0 or above
• libpng → 1.6.55-r0 or above
• zlib → 1.3.2-r0 or above

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-25646
• https://nvd.nist.gov/vuln/detail/CVE-2026-22184
• https://nvd.nist.gov/vuln/detail/CVE-2026-32777
• https://nvd.nist.gov/vuln/detail/CVE-2026-32778
• https://nvd.nist.gov/vuln/detail/CVE-2026-27171

[azurejelly]

CVE-2026-32767 doesn't even correspond to libexpat, it corresponds to a SQL injection vulnerability on an app called SiYuan. We don't even have or connect to a SQL database, all the container does is serve static files using nginx.

https://www.cve.org/CVERecord?id=CVE-2026-32767
https://nvd.nist.gov/vuln/detail/CVE-2026-32767
https://github.com/advisories/GHSA-j7wh-x834-p3r7 

[Kofysh]

CVE-2026-32767 doesn't even correspond to libexpat, it corresponds to a SQL injection vulnerability on an app called SiYuan. We don't even have or connect to a SQL database, all the container does is serve static files using nginx.

https://www.cve.org/CVERecord?id=CVE-2026-32767 https://nvd.nist.gov/vuln/detail/CVE-2026-32767 https://github.com/advisories/GHSA-j7wh-x834-p3r7

You're absolutely right, my apologies for the confusion ! I must have made an error when mapping the CVEs to the affected packages. CVE-2026-32767 does indeed refer to a SiYuan SQL injection vulnerability and has no relevance to libexpat or this project.

I'll review the other CVEs more carefully as well to make sure the report is accurate before resubmitting. Thanks for catching that !