CVE-2026-79705
Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
- Record
CVE-2026-79705- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-78823
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
- Record
EUVD-2026-78823- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fmxx-r7q4-v8m6
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root...
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
- Record
GHSA-fmxx-r7q4-v8m6- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
- Record
CVE-2026-79705- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-79705
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
- Record
ALPINE-CVE-2026-79705- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSVBELL-CVE-2026-79705
- Record
BELL-CVE-2026-79705- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2026-79705
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
- Record
DEBIAN-CVE-2026-79705- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:74861
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:74861- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-79705
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
- Record
UBUNTU-CVE-2026-79705- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVAZL-103065 No score
CVE-2026-79705 affecting package buildah 1.43.1-3
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
- Record
AZL-103065- Updated
- 2026-11-02
OSVAZL-103091 No score
CVE-2026-79705 affecting package podman 5.6.1-10
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
- Record
AZL-103091- Updated
- 2026-11-02
OSVAZL-103230 No score
CVE-2026-79705 affecting package libcontainers-common 20240213-3
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
- Record
AZL-103230- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
podmanAlpine:v3.24 |
before 5.8.8-r0 | 5.8.8-r0 |
buildahAzure Linux:3 |
through 1.43.1-3 | None known |
podmanAzure Linux:3 |
through 5.6.1-10 | None known |
libcontainers-commonAzure Linux:3 |
through 20240213-3 | None known |
buildahAlpaquita:stream |
1.31.0-r0 up to 1.45.1-r0 | 1.45.1-r0 |
podmanAlpaquita:stream |
4.5.1-r1 up to 6.1.3-r0 | 6.1.3-r0 |
golang-github-containers-buildahDebian:12 |
All versions, plus listed versions 1.28.2+ds1-31.28.2+ds1-3+deb12u11.29.0+ds1-11.30.0+ds1-11.30.0+ds1-2 Show 45 moreShow less1.30.0+ds1-31.31.2+ds1-11.31.2+ds1-21.31.2+ds1-31.32.0+ds1-11.32.0+ds1-21.32.2+ds1-11.33.1+ds1-11.33.1+ds1-21.33.3+ds1-11.33.3+ds1-21.33.5+ds1-31.33.5+ds1-41.33.7+ds1-11.34.0+ds1-11.34.0+ds1-21.35.3+ds1-11.35.3+ds1-21.35.3+ds1-31.37.0+ds1-11.37.1+ds1-11.37.1+ds1-21.37.2+ds1-11.37.2+ds1-21.37.2+ds1-31.37.3+ds1-11.37.3+ds1-21.37.3+ds1-31.37.4+ds1-11.37.5+ds1-11.38.0+ds1-11.38.0+ds1-21.38.1+ds1-11.39.0+ds1-11.39.3+ds1-11.41.4+ds1-11.41.4+ds1-21.41.4+ds1-31.41.5+ds1-11.41.5+ds1-21.41.5+ds1-31.41.5+ds1-41.42.1+ds1-11.42.1+ds1-21.43.0+ds1-1 |
None known |
golang-github-containers-buildahDebian:13 |
All versions, plus listed versions 1.39.3+ds1-11.41.4+ds1-11.41.4+ds1-21.41.4+ds1-31.41.5+ds1-1 Show 15 moreShow less1.41.5+ds1-21.41.5+ds1-31.41.5+ds1-41.42.1+ds1-11.42.1+ds1-21.43.0+ds1-11.43.0+ds1-21.43.1+ds1-11.43.1+ds1-21.43.1+ds1-31.43.2+ds1-11.43.2+ds1-21.43.2+ds1-31.45.0+ds1-11.45.0+ds1-2 |
None known |
golang-github-containers-buildahDebian:14 |
All versions, plus listed versions 1.39.3+ds1-11.41.4+ds1-11.41.4+ds1-21.41.4+ds1-31.41.5+ds1-1 Show 15 moreShow less1.41.5+ds1-21.41.5+ds1-31.41.5+ds1-41.42.1+ds1-11.42.1+ds1-21.43.0+ds1-11.43.0+ds1-21.43.1+ds1-11.43.1+ds1-21.43.1+ds1-31.43.2+ds1-11.43.2+ds1-21.43.2+ds1-31.45.0+ds1-11.45.0+ds1-2 |
None known |
podmanRed Hat:hummingbird:1 |
before 0:6.1.3-1.hum1 | 0:6.1.3-1.hum1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
podman-dockerRed Hat:hummingbird:1 |
before 0:6.1.3-1.hum1 | 0:6.1.3-1.hum1 |
podman-machineRed Hat:hummingbird:1 |
before 0:6.1.3-1.hum1 | 0:6.1.3-1.hum1 |
podman-remoteRed Hat:hummingbird:1 |
before 0:6.1.3-1.hum1 | 0:6.1.3-1.hum1 |
podmanshRed Hat:hummingbird:1 |
before 0:6.1.3-1.hum1 | 0:6.1.3-1.hum1 |
golang-github-containers-buildahUbuntu:22.04:LTS |
All versions, plus listed versions 1.21.3+ds1-1ubuntu11.23.1+ds1-2 |
None known |
golang-github-containers-buildahUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.28.2+ds1-3build11.32.2+ds1-11.33.1+ds1-21.33.3+ds1-21.33.5+ds1-4 Show 10 moreShow less1.33.5+ds1-4build11.33.5+ds1-4build21.33.7+ds1-11.33.7+ds1-1ubuntu0.24.04.11.33.7+ds1-1ubuntu0.24.04.21.33.7+ds1-1ubuntu0.24.04.2+esm11.33.7+ds1-1ubuntu0.24.04.2+esm21.33.7+ds1-1ubuntu0.24.04.31.33.7+ds1-1ubuntu0.24.04.3+esm21.33.7+ds1-1ubuntu0.24.04.3+esm3 |
None known |
golang-github-containers-buildahUbuntu:26.10 |
All versions, plus listed versions 1.42.1+ds1-2build11.43.2+ds1-3 |
None known |
golang-github-containers-buildahUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 1.39.3+ds1-1syncable11.42.1+ds1-21.42.1+ds1-2build11.42.1+ds1-2ubuntu0.26.04.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-79705 is a medium vulnerability (CVSS 4.5) in Red Hat Ansible Automation Platform 2, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in podman 5.8.8-r0.
References
access.redhat.com/errata/RHSA-2026:74861
bugzilla.redhat.com/show_bug.cgi?id=2523419
nvd.nist.gov/vuln/detail/CVE-2026-79705
github.com/advisories/GHSA-fmxx-r7q4-v8m6
security.alpinelinux.org/vuln/CVE-2026-79705
Show 18 moreShow less
docs.bell-sw.com/security/cves/CVE-2026-79705
security-tracker.debian.org/tracker/CVE-2026-79705
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74861.json
cve.org/CVERecord?id=CVE-2026-56851
go.dev/cl/793360
pkg.go.dev/vuln/GO-2026-6629
ubuntu.com/security/CVE-2026-79705
Left out here: 9 versions. The JSON record has them.