CVE-2022-4123
Buildah (as part of Podman) vulnerable to Path Traversal
CVE-2022-4123 is a low vulnerability (CVSS 3.3) in Containers Podman, published December 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in podman 5.6.1-2.
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
CVE-2022-4123- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-23, CWE-22
- Updated
- 2026-11-02
CVE List
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
CVE-2022-4123- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-23, CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2022-7738
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
EUVD-2022-7738- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rprg-4v7q-87v7
Buildah (as part of Podman) vulnerable to Path Traversal
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
GHSA-rprg-4v7q-87v7- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-23
- Updated
- 2026-11-02
OSVAZL-11587
CVE-2022-4123 affecting package podman 4.1.1-26
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
AZL-11587- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVAZL-36977
CVE-2022-4123 affecting package podman for versions less than 5.6.1-2
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
AZL-36977- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSV
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
CVE-2022-4123- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-23
- Updated
- 2026-11-02
OSVGHSA-rprg-4v7q-87v7
Buildah (as part of Podman) vulnerable to Path Traversal
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
GHSA-rprg-4v7q-87v7- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-23
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-4123
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
UBUNTU-CVE-2022-4123- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-4123 No score
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
DEBIAN-CVE-2022-4123- Updated
- 2026-11-03
OSVGO-2022-1159 No score
Path traversal in github.com/containers/podman/v4
The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
- Record
GO-2022-1159- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/containers/podman/v4Go |
4.1.0-rc1 to 4.4.1 | None known |
podmanAzure Linux:2 |
through 4.1.1-26 | None known |
podmanAzure Linux:3 |
before 5.6.1-2 | 5.6.1-2 |
golang-github-containers-buildahDebian:12 |
All versions, plus listed versions 1.28.2+ds1-31.28.2+ds1-3+deb12u11.29.0+ds1-11.30.0+ds1-11.30.0+ds1-2 Show 45 moreShow less1.30.0+ds1-31.31.2+ds1-11.31.2+ds1-21.31.2+ds1-31.32.0+ds1-11.32.0+ds1-21.32.2+ds1-11.33.1+ds1-11.33.1+ds1-21.33.3+ds1-11.33.3+ds1-21.33.5+ds1-31.33.5+ds1-41.33.7+ds1-11.34.0+ds1-11.34.0+ds1-21.35.3+ds1-11.35.3+ds1-21.35.3+ds1-31.37.0+ds1-11.37.1+ds1-11.37.1+ds1-21.37.2+ds1-11.37.2+ds1-21.37.2+ds1-31.37.3+ds1-11.37.3+ds1-21.37.3+ds1-31.37.4+ds1-11.37.5+ds1-11.38.0+ds1-11.38.0+ds1-21.38.1+ds1-11.39.0+ds1-11.39.3+ds1-11.41.4+ds1-11.41.4+ds1-21.41.4+ds1-31.41.5+ds1-11.41.5+ds1-21.41.5+ds1-31.41.5+ds1-41.42.1+ds1-11.42.1+ds1-21.43.0+ds1-1 |
None known |
golang-github-containers-buildahDebian:13 |
All versions, plus listed versions 1.39.3+ds1-11.41.4+ds1-11.41.4+ds1-21.41.4+ds1-31.41.5+ds1-1 Show 15 moreShow less1.41.5+ds1-21.41.5+ds1-31.41.5+ds1-41.42.1+ds1-11.42.1+ds1-21.43.0+ds1-11.43.0+ds1-21.43.1+ds1-11.43.1+ds1-21.43.1+ds1-31.43.2+ds1-11.43.2+ds1-21.43.2+ds1-31.45.0+ds1-11.45.0+ds1-2 |
None known |
golang-github-containers-buildahDebian:14 |
All versions, plus listed versions 1.39.3+ds1-11.41.4+ds1-11.41.4+ds1-21.41.4+ds1-31.41.5+ds1-1 Show 15 moreShow less1.41.5+ds1-21.41.5+ds1-31.41.5+ds1-41.42.1+ds1-11.42.1+ds1-21.43.0+ds1-11.43.0+ds1-21.43.1+ds1-11.43.1+ds1-21.43.1+ds1-31.43.2+ds1-11.43.2+ds1-21.43.2+ds1-31.45.0+ds1-11.45.0+ds1-2 |
None known |
github.com/containers/podman/v4Go |
4.1.0-rc1 and later | None known |
golang-github-containers-buildahUbuntu:22.04:LTS |
All versions, plus listed versions 1.21.3+ds1-1ubuntu11.23.1+ds1-2 |
None known |
golang-github-containers-buildahUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.28.2+ds1-3build11.32.2+ds1-11.33.1+ds1-21.33.3+ds1-21.33.5+ds1-4 Show 10 moreShow less1.33.5+ds1-4build11.33.5+ds1-4build21.33.7+ds1-11.33.7+ds1-1ubuntu0.24.04.11.33.7+ds1-1ubuntu0.24.04.21.33.7+ds1-1ubuntu0.24.04.2+esm11.33.7+ds1-1ubuntu0.24.04.2+esm21.33.7+ds1-1ubuntu0.24.04.31.33.7+ds1-1ubuntu0.24.04.3+esm21.33.7+ds1-1ubuntu0.24.04.3+esm3 |
None known |
golang-github-containers-buildahUbuntu:25.10 |
All versions, plus listed versions 1.39.3+ds1-1syncable1 |
None known |
golang-github-containers-buildahUbuntu:26.10 |
All versions, plus listed versions 1.42.1+ds1-2build11.43.2+ds1-3 |
None known |
golang-github-containers-buildahUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 1.39.3+ds1-1syncable11.42.1+ds1-21.42.1+ds1-2build11.42.1+ds1-2ubuntu0.26.04.1~esm1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=2144989
nvd.nist.gov/vuln/detail/CVE-2022-4123
github.com/containers/podman/issues/13293
pkg.go.dev/vuln/GO-2022-1159
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2022-4123
ubuntu.com/security/CVE-2022-4123
access.redhat.com/security/cve/CVE-2022-4123
cve.org/CVERecord?id=CVE-2022-4123
Left out here: 9 versions. The JSON record has them.