CVE-2026-79699
Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory
CVE-2026-79699 is a medium vulnerability (CVSS 4.4) in Red Hat Ansible Automation Platform 2, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in podman 5.8.8-r0.
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
CVE-2026-79699- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2026-78824
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
EUVD-2026-78824- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p44w-25fh-fx4c
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious...
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
GHSA-p44w-25fh-fx4c- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
CVE-2026-79699- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-79699
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
ALPINE-CVE-2026-79699- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-03
OSVBELL-CVE-2026-79699
- Record
BELL-CVE-2026-79699- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2026-79699
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
DEBIAN-CVE-2026-79699- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-79699
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
UBUNTU-CVE-2026-79699- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVAZL-103062 No score
CVE-2026-79699 affecting package buildah 1.43.1-3
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
AZL-103062- Updated
- 2026-11-02
OSVAZL-103071 No score
CVE-2026-79699 affecting package cri-o 1.30.1-1
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
AZL-103071- Updated
- 2026-11-02
OSVAZL-103089 No score
CVE-2026-79699 affecting package podman 5.6.1-10
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
AZL-103089- Updated
- 2026-11-02
OSVAZL-103140 No score
CVE-2026-79699 affecting package containerized-data-importer 1.62.0-9
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
AZL-103140- Updated
- 2026-11-02
OSVAZL-103227 No score
CVE-2026-79699 affecting package libcontainers-common 20240213-3
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
AZL-103227- Updated
- 2026-11-02
OSVAZL-103269 No score
CVE-2026-79699 affecting package skopeo 1.14.4-15
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
AZL-103269- Updated
- 2026-11-02
OSVAZL-108396 No score
CVE-2026-79699 affecting package moby-engine 25.0.18-1
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
- Record
AZL-108396- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12068-1 No score
podman-6.1.2-1.1 on GA media
These are all security issues fixed in the podman-6.1.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12068-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
podmanAlpine:v3.24 |
before 5.8.8-r0 | 5.8.8-r0 |
buildahAzure Linux:3 |
through 1.43.1-3 | None known |
cri-oAzure Linux:3 |
through 1.30.1-1 | None known |
podmanAzure Linux:3 |
through 5.6.1-10 | None known |
containerized-data-importerAzure Linux:3 |
through 1.62.0-9 | None known |
libcontainers-commonAzure Linux:3 |
through 20240213-3 | None known |
skopeoAzure Linux:3 |
through 1.14.4-15 | None known |
moby-engineAzure Linux:3 |
through 25.0.18-1 | None known |
podmanAlpaquita:stream |
4.5.1-r1 up to 6.1.3-r0 | 6.1.3-r0 |
golang-github-containers-storageDebian:12 |
All versions, plus listed versions 1.43.0+ds1-81.44.0+ds1-11.45.1+ds1-11.45.1+ds1-21.46.1+ds1-1 Show 36 moreShow less1.46.1+ds1-21.46.1+ds1-31.46.1+ds1-41.48.1+ds1-11.48.1+ds1-21.48.1+ds1-2~bpo12+11.50.2+ds1-11.50.2+ds1-21.51.0+ds1-11.51.0+ds1-21.52.0+ds1-11.53.0+ds1-11.53.0+ds1-21.55.0+ds1-11.55.0+ds1-21.55.0+ds1-31.55.1+ds1-11.56.0+ds1-11.56.0+ds1-21.56.1+ds1-11.57.1+ds1-11.57.2+ds1-11.59.1+ds1-11.59.1+ds1-21.59.1+ds1-31.61.0+ds1-11.61.0+ds1-21.61.0+ds1-31.61.0+ds1-41.61.0+ds1-51.61.0+ds1-61.62.0-11.62.0-21.62.0-31.63.0-11.64.0-1 |
None known |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
golang-github-containers-storageDebian:13 |
All versions, plus listed versions 1.57.2+ds1-11.59.1+ds1-11.59.1+ds1-21.59.1+ds1-31.61.0+ds1-1 Show 10 moreShow less1.61.0+ds1-21.61.0+ds1-31.61.0+ds1-41.61.0+ds1-51.61.0+ds1-61.62.0-11.62.0-21.62.0-31.63.0-11.64.0-1 |
None known |
golang-github-containers-storageDebian:14 |
All versions, plus listed versions 1.57.2+ds1-11.59.1+ds1-11.59.1+ds1-21.59.1+ds1-31.61.0+ds1-1 Show 10 moreShow less1.61.0+ds1-21.61.0+ds1-31.61.0+ds1-41.61.0+ds1-51.61.0+ds1-61.62.0-11.62.0-21.62.0-31.63.0-11.64.0-1 |
None known |
golang-github-containers-storageUbuntu:20.04:LTS |
All versions, plus listed versions 1.13.2+dfsg1-21.13.2+dfsg1-31.13.5+dfsg1-11.15.1+dfsg1-11.15.2+dfsg1-1 Show 7 moreShow less1.15.3+dfsg1-11.15.5+dfsg1-11.15.7+dfsg1-11.15.8+dfsg1-11.15.8+dfsg1-1ubuntu11.15.8+dfsg1-1ubuntu21.15.8+dfsg1-1ubuntu2.1 |
None known |
golang-github-containers-storageUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.31.3+ds1-1ubuntu11.36.0+ds1-21.36.0+ds1-2ubuntu0.11.36.0+ds1-2ubuntu0.1+esm11.36.0+ds1-2ubuntu0.1+esm2 |
None known |
golang-github-containers-storageUbuntu:24.04:LTS |
All versions, plus listed versions 1.43.0+ds1-8build11.50.2+ds1-21.51.0+ds1-21.51.0+ds1-2ubuntu0.24.04.11.51.0+ds1-2ubuntu0.24.04.21.51.0+ds1-2ubuntu0.24.04.3 |
None known |
golang-github-containers-storageUbuntu:26.10 |
All versions, plus listed versions 1.61.0+ds1-61.62.0-31.63.0-1 |
None known |
golang-github-containers-storageUbuntu:26.04:LTS |
All versions, plus listed versions 1.57.2+ds1-11.61.0+ds1-6 |
None known |
podmanopenSUSE:Tumbleweed |
before 6.1.2-1.1 | 6.1.2-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected, aliases, references | OSV |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |