Every CVE Search/ Get API key

CVE-2026-79699

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

4.4 MediumFix available

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.17%Unchanged since Sep 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.4

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
CVE-2026-79699
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-59
Updated
2026-11-06
EUVDEUVD-2026-78824 4.4

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
EUVD-2026-78824
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-06
GitHub AdvisoriesGHSA-p44w-25fh-fx4c 4.4

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious...

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
GHSA-p44w-25fh-fx4c
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-59
Updated
2026-11-02
NVD 4.4

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
CVE-2026-79699
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-59
Updated
2026-11-06
OSVALPINE-CVE-2026-79699 4.4

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
ALPINE-CVE-2026-79699
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-03
OSVBELL-CVE-2026-79699 4.4
Record
BELL-CVE-2026-79699
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2026-79699 4.4

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
DEBIAN-CVE-2026-79699
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-07
OSVUBUNTU-CVE-2026-79699 4.4

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
UBUNTU-CVE-2026-79699
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVAZL-103062 No score

CVE-2026-79699 affecting package buildah 1.43.1-3

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
AZL-103062
Updated
2026-11-05
OSVAZL-103071 No score

CVE-2026-79699 affecting package cri-o 1.30.1-1

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
AZL-103071
Updated
2026-11-05
OSVAZL-103089 No score

CVE-2026-79699 affecting package podman 5.6.1-10

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
AZL-103089
Updated
2026-11-05
OSVAZL-103140 No score

CVE-2026-79699 affecting package containerized-data-importer 1.62.0-9

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
AZL-103140
Updated
2026-11-05
OSVAZL-103227 No score

CVE-2026-79699 affecting package libcontainers-common 20240213-3

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
AZL-103227
Updated
2026-11-02
OSVAZL-103269 No score

CVE-2026-79699 affecting package skopeo 1.14.4-15

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
AZL-103269
Updated
2026-11-05
OSVAZL-108396 No score

CVE-2026-79699 affecting package moby-engine 25.0.18-1

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Record
AZL-108396
Updated
2026-11-05
OSVopenSUSE-SU-2026:12068-1 No score

podman-6.1.2-1.1 on GA media

These are all security issues fixed in the podman-6.1.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12068-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12478-1 No score

skopeo-1.24.0-2.1 on GA media

These are all security issues fixed in the skopeo-1.24.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12478-1
Updated
2026-11-07

Affected products

Affected packages

Affected packages
PackageAffectedFixed
podman
Alpine:v3.24
 before 5.8.8-r0
5.8.8-r0
buildah
Azure Linux:3
 through 1.43.1-3 None known
cri-o
Azure Linux:3
 through 1.30.1-1 None known
podman
Azure Linux:3
 through 5.6.1-10 None known
containerized-data-importer
Azure Linux:3
 through 1.62.0-9 None known
libcontainers-common
Azure Linux:3
 through 20240213-3 None known
skopeo
Azure Linux:3
 through 1.14.4-15 None known
moby-engine
Azure Linux:3
 through 25.0.18-1 None known
podman
Alpaquita:stream
 4.5.1-r1 up to 6.1.3-r0
6.1.3-r0
golang-github-containers-storage
Debian:12
 All versions, plus listed versions
1.43.0+ds1-81.44.0+ds1-11.45.1+ds1-11.45.1+ds1-21.46.1+ds1-1
Show 36 moreShow less
1.46.1+ds1-21.46.1+ds1-31.46.1+ds1-41.48.1+ds1-11.48.1+ds1-21.48.1+ds1-2~bpo12+11.50.2+ds1-11.50.2+ds1-21.51.0+ds1-11.51.0+ds1-21.52.0+ds1-11.53.0+ds1-11.53.0+ds1-21.55.0+ds1-11.55.0+ds1-21.55.0+ds1-31.55.1+ds1-11.56.0+ds1-11.56.0+ds1-21.56.1+ds1-11.57.1+ds1-11.57.2+ds1-11.59.1+ds1-11.59.1+ds1-21.59.1+ds1-31.61.0+ds1-11.61.0+ds1-21.61.0+ds1-31.61.0+ds1-41.61.0+ds1-51.61.0+ds1-61.62.0-11.62.0-21.62.0-31.63.0-11.64.0-1
 None known
Show 9 moreShow less
Affected packages
PackageAffectedFixed
golang-github-containers-storage
Debian:13
 All versions, plus listed versions
1.57.2+ds1-11.59.1+ds1-11.59.1+ds1-21.59.1+ds1-31.61.0+ds1-1
Show 10 moreShow less
1.61.0+ds1-21.61.0+ds1-31.61.0+ds1-41.61.0+ds1-51.61.0+ds1-61.62.0-11.62.0-21.62.0-31.63.0-11.64.0-1
 None known
golang-github-containers-storage
Debian:14
 All versions, plus listed versions
1.57.2+ds1-11.59.1+ds1-11.59.1+ds1-21.59.1+ds1-31.61.0+ds1-1
Show 10 moreShow less
1.61.0+ds1-21.61.0+ds1-31.61.0+ds1-41.61.0+ds1-51.61.0+ds1-61.62.0-11.62.0-21.62.0-31.63.0-11.64.0-1
 None known
golang-github-containers-storage
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.13.2+dfsg1-21.13.2+dfsg1-31.13.5+dfsg1-11.15.1+dfsg1-11.15.2+dfsg1-1
Show 7 moreShow less
1.15.3+dfsg1-11.15.5+dfsg1-11.15.7+dfsg1-11.15.8+dfsg1-11.15.8+dfsg1-1ubuntu11.15.8+dfsg1-1ubuntu21.15.8+dfsg1-1ubuntu2.1
 None known
golang-github-containers-storage
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.31.3+ds1-1ubuntu11.36.0+ds1-21.36.0+ds1-2ubuntu0.11.36.0+ds1-2ubuntu0.1+esm11.36.0+ds1-2ubuntu0.1+esm2
 None known
golang-github-containers-storage
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.43.0+ds1-8build11.50.2+ds1-21.51.0+ds1-21.51.0+ds1-2ubuntu0.24.04.11.51.0+ds1-2ubuntu0.24.04.21.51.0+ds1-2ubuntu0.24.04.3
 None known
golang-github-containers-storage
Ubuntu:26.10
 All versions, plus listed versions
1.61.0+ds1-61.62.0-31.63.0-1
 None known
golang-github-containers-storage
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.57.2+ds1-11.61.0+ds1-6
 None known
podman
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 6.1.2-1.1
6.1.2-1.1
skopeo
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.24.0-2.1
1.24.0-2.1

History

History
RecordedChangedSources
affected, aliases, referencesCVE List, EUVD, NVD, OSV
affected
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-79699 is a medium vulnerability (CVSS 4.4) in Red Hat Ansible Automation Platform 2, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in podman 5.8.8-r0.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open