Every CVE Search/ Get API key

CVE-2019-10152

Podman Path Traversal Vulnerability leads to arbitrary file read/write

7.5 HighFix available

CVE-2019-10152 is a high vulnerability (CVSS 7.5) in Containers Podman, published July 30, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in github.com/containers/podman 1.4.0.

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.47%Down 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Record
CVE-2019-10152
CVSS 3.0
7.5 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-59, CWE-22
Updated
2026-11-02
EUVDEUVD-2022-5173 7.5

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Record
EUVD-2022-5173
CVSS 3.0
7.5 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-rh5f-2w6r-q7vj 7.2

Podman Path Traversal Vulnerability leads to arbitrary file read/write

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Record
GHSA-rh5f-2w6r-q7vj
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
NVD 7.2

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Record
CVE-2019-10152
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS 3.0
7.5 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 2.0
2.6 LowAV:L/AC:H/Au:N/C:P/I:P/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
OSV 7.2

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Record
CVE-2019-10152
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVGHSA-rh5f-2w6r-q7vj 7.2

Podman Path Traversal Vulnerability leads to arbitrary file read/write

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Record
GHSA-rh5f-2w6r-q7vj
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2019:1907 7.5

Red Hat Security Advisory: podman security, bug fix, and enhancement update

Record
RHSA-2019:1907
CVSS 3.0
7.5 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVGO-2023-1927 No score

Podman Path Traversal Vulnerability leads to arbitrary file read/write in github.com/containers/podman

Podman Path Traversal Vulnerability leads to arbitrary file read/write in github.com/containers/podman

Record
GO-2023-1927
Updated
2026-11-02
OSVopenSUSE-SU-2019:2044-1 No score

Security update for podman, slirp4netns and libcontainers-common

This is a version update for podman to version 1.4.4 (bsc#1143386).

Additional changes by SUSE on top:

  • Remove fuse-overlayfs because it's (currently) an unsatisfied dependency on SLE (bsc#1143386)
  • Update libpod.conf to use correct infra_command
  • Update libpod.conf to use better versioned pause container
  • Update libpod.conf to use official kubic pause container
  • Update libpod.conf to match latest features set: detach_keys, lock_type, runtime_supports_json
  • Add podman-remote varlink client

Version update podman to v1.4.4:

  • Features

    • Podman now has greatly improved support for containers using multiple OCI runtimes. Containers now remember if they were created with a different runtime using --runtime and will always use that runtime
    • The cached and delegated options for volume mounts are now allowed for Docker compatability (#3340)
    • The podman diff command now supports the --latest flag

  • Bugfixes

    • Fixed a bug where rootless Podman would attempt to use the entire root configuration if no rootless configuration was present for the user, breaking rootless Podman for new installations
    • Fixed a bug where rootless Podman's pause process would block SIGTERM, preventing graceful system shutdown and hanging until the system's init send SIGKILL
    • Fixed a bug where running Podman as root with sudo -E would not work after running rootless Podman at least once
    • Fixed a bug where options for tmpfs volumes added with the --tmpfs flag were being ignored
    • Fixed a bug where images with no layers could not properly be displayed and removed by Podman
    • Fixed a bug where locks were not properly freed on failure to create a container or pod
    • Fixed a bug where podman cp on a single file would create a directory at the target and place the file in it (#3384)
    • Fixed a bug where podman inspect --format '{{.Mounts}}' would print a hexadecimal address instead of a container's mounts
    • Fixed a bug where rootless Podman would not add an entry to container's /etc/hosts files for their own hostname (#3405)
    • Fixed a bug where podman ps --sync would segfault (#3411)
    • Fixed a bug where podman generate kube would produce an invalid ports configuration (#3408)

  • Misc

    • Updated containers/storage to v1.12.13
    • Podman now performs much better on systems with heavy I/O load
    • The --cgroup-manager flag to podman now shows the correct default setting in help if the default was overridden by libpod.conf
    • For backwards compatability, setting --log-driver=json-file in podman run is now supported as an alias for --log-driver=k8s-file. This is considered deprecated, and json-file will be moved to a new implementation in the future ([#3363](https://github.com/containers/libpo
      d/issues/3363))
    • Podman's default libpod.conf file now allows the crun OCI runtime to be used if it is installed

Update podman to v1.4.2:

  • Fixed a bug where Podman could not run containers using an older version of Systemd as init
  • Updated vendored Buildah to v1.9.0 to resolve a critical bug with Dockerfile RUN instructions
  • The error message for running podman kill on containers that are not running has been improved
  • Podman remote client can now log to a file if syslog is not available
  • The podman exec command now sets its error code differently based on whether the container does not exist, and the command in the container does not exist
  • The podman inspect command on containers now outputs Mounts JSON that matches that of docker inspect, only including user-specified volumes and differentiating bind mounts and named volumes
  • The podman inspect command now reports the path to a container's OCI spec with the OCIConfigPath key (only included when the container is initialized or running)
  • The podman run --mount command now supports the bind-nonrecursive option for bind mounts
  • Fixed a bug where podman play kube…
Record
openSUSE-SU-2019:2044-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10931-1 No score

libcontainers-common-20210626-5.1 on GA media

These are all security issues fixed in the libcontainers-common-20210626-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10931-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11177-1 No score

podman-3.3.1-2.1 on GA media

These are all security issues fixed in the podman-3.3.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11177-1
Updated
2026-11-02
OSVSUSE-SU-2019:2223-1 No score

Security update for podman, slirp4netns and libcontainers-common

This is a version update for podman to version 1.4.4 (bsc#1143386).

Additional changes by SUSE on top:

  • Remove fuse-overlayfs because it's (currently) an unsatisfied dependency on SLE (bsc#1143386)
  • Update libpod.conf to use correct infra_command
  • Update libpod.conf to use better versioned pause container
  • Update libpod.conf to use official kubic pause container
  • Update libpod.conf to match latest features set: detach_keys, lock_type, runtime_supports_json
  • Add podman-remote varlink client

Version update podman to v1.4.4:

  • Features

    • Podman now has greatly improved support for containers using multiple OCI runtimes. Containers now remember if they were created with a different runtime using --runtime and will always use that runtime
    • The cached and delegated options for volume mounts are now allowed for Docker compatability (#3340)
    • The podman diff command now supports the --latest flag

  • Bugfixes

    • Fixed a bug where rootless Podman would attempt to use the entire root configuration if no rootless configuration was present for the user, breaking rootless Podman for new installations
    • Fixed a bug where rootless Podman's pause process would block SIGTERM, preventing graceful system shutdown and hanging until the system's init send SIGKILL
    • Fixed a bug where running Podman as root with sudo -E would not work after running rootless Podman at least once
    • Fixed a bug where options for tmpfs volumes added with the --tmpfs flag were being ignored
    • Fixed a bug where images with no layers could not properly be displayed and removed by Podman
    • Fixed a bug where locks were not properly freed on failure to create a container or pod
    • Fixed a bug where podman cp on a single file would create a directory at the target and place the file in it (#3384)
    • Fixed a bug where podman inspect --format '{{.Mounts}}' would print a hexadecimal address instead of a container's mounts
    • Fixed a bug where rootless Podman would not add an entry to container's /etc/hosts files for their own hostname (#3405)
    • Fixed a bug where podman ps --sync would segfault (#3411)
    • Fixed a bug where podman generate kube would produce an invalid ports configuration (#3408)

  • Misc

    • Updated containers/storage to v1.12.13
    • Podman now performs much better on systems with heavy I/O load
    • The --cgroup-manager flag to podman now shows the correct default setting in help if the default was overridden by libpod.conf
    • For backwards compatability, setting --log-driver=json-file in podman run is now supported as an alias for --log-driver=k8s-file. This is considered deprecated, and json-file will be moved to a new implementation in the future ([#3363](https://github.com/containers/libpo
      d/issues/3363))
    • Podman's default libpod.conf file now allows the crun OCI runtime to be used if it is installed

Update podman to v1.4.2:

  • Fixed a bug where Podman could not run containers using an older version of Systemd as init
  • Updated vendored Buildah to v1.9.0 to resolve a critical bug with Dockerfile RUN instructions
  • The error message for running podman kill on containers that are not running has been improved
  • Podman remote client can now log to a file if syslog is not available
  • The podman exec command now sets its error code differently based on whether the container does not exist, and the command in the container does not exist
  • The podman inspect command on containers now outputs Mounts JSON that matches that of docker inspect, only including user-specified volumes and differentiating bind mounts and named volumes
  • The podman inspect command now reports the path to a container's OCI spec with the OCIConfigPath key (only included when the container is initialized or running)
  • The podman run --mount command now supports the bind-nonrecursive option for bind mounts
  • Fixed a bug where podman play kube…
Record
SUSE-SU-2019:2223-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/containers/podman
Go
 before 1.4.0
1.4.0
podman
Red Hat:rhel_extras_other:7
 before 0:1.4.4-2.el7
0:1.4.4-2.el7
podman-debuginfo
Red Hat:rhel_extras_other:7
 before 0:1.4.4-2.el7
0:1.4.4-2.el7
podman-docker
Red Hat:rhel_extras_other:7
 before 0:1.4.4-2.el7
0:1.4.4-2.el7
libcontainers-common
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 20190401-3.3.5
20190401-3.3.5
fuse-overlayfs
SUSE:Linux Enterprise Module for Containers 15 SP1
 before 0.4.1-3.3.8
0.4.1-3.3.8
fuse3
SUSE:Linux Enterprise Module for Containers 15 SP1
 before 3.6.1-3.3.8
3.6.1-3.3.8
podman
SUSE:Linux Enterprise Module for Containers 15 SP1
 before 1.4.4-4.8.1
1.4.4-4.8.1
slirp4netns
SUSE:Linux Enterprise Module for Containers 15 SP1
 before 0.3.0-3.3.3
0.3.0-3.3.3
fuse-overlayfs
openSUSE:Leap 15.1
 before 0.4.1-lp151.2.1
0.4.1-lp151.2.1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
fuse3
openSUSE:Leap 15.1
 before 3.6.1-lp151.2.1
3.6.1-lp151.2.1
libcontainers-common
openSUSE:Leap 15.1
 before 20190401-lp151.2.3.1
20190401-lp151.2.3.1
podman
openSUSE:Leap 15.1
 before 1.4.4-lp151.3.3.1
1.4.4-lp151.3.3.1
slirp4netns
openSUSE:Leap 15.1
 before 0.3.0-lp151.2.3.1
0.3.0-lp151.2.3.1
libcontainers-common
openSUSE:Tumbleweed
 before 20210626-5.1
20210626-5.1
podman
openSUSE:Tumbleweed
 before 3.3.1-2.1
3.3.1-2.1

History

History
WhenChangedSources
2026-11-03aliases, productsEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 28 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open