{"id":"CVE-2026-79699","aliases":["ALPINE-CVE-2026-79699","AZL-103062","AZL-103071","AZL-103089","AZL-103140","AZL-103227","AZL-103269","AZL-108396","BELL-CVE-2026-79699","DEBIAN-CVE-2026-79699","EUVD-2026-78824","GHSA-p44w-25fh-fx4c","UBUNTU-CVE-2026-79699","openSUSE-SU-2026:12068-1","openSUSE-SU-2026:12478-1"],"status":"published","title":"Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00173,"percentile":0.06794,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-09-15T16:25:16Z","modified":"2026-11-07T17:23:17Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"podman","fixed_in":["5.8.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"podman","fixed_in":["6.1.3-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.8-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.62.0-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcontainers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240213-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.4-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.18-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-r1"},{"fixed":"6.1.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-containers-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.43.0+ds1-8","1.44.0+ds1-1","1.45.1+ds1-1","1.45.1+ds1-2","1.46.1+ds1-1","1.46.1+ds1-2","1.46.1+ds1-3","1.46.1+ds1-4","1.48.1+ds1-1","1.48.1+ds1-2","1.48.1+ds1-2~bpo12+1","1.50.2+ds1-1","1.50.2+ds1-2","1.51.0+ds1-1","1.51.0+ds1-2","1.52.0+ds1-1","1.53.0+ds1-1","1.53.0+ds1-2","1.55.0+ds1-1","1.55.0+ds1-2","1.55.0+ds1-3","1.55.1+ds1-1","1.56.0+ds1-1","1.56.0+ds1-2","1.56.1+ds1-1","1.57.1+ds1-1","1.57.2+ds1-1","1.59.1+ds1-1","1.59.1+ds1-2","1.59.1+ds1-3","1.61.0+ds1-1","1.61.0+ds1-2","1.61.0+ds1-3","1.61.0+ds1-4","1.61.0+ds1-5","1.61.0+ds1-6","1.62.0-1","1.62.0-2","1.62.0-3","1.63.0-1","1.64.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-containers-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.57.2+ds1-1","1.59.1+ds1-1","1.59.1+ds1-2","1.59.1+ds1-3","1.61.0+ds1-1","1.61.0+ds1-2","1.61.0+ds1-3","1.61.0+ds1-4","1.61.0+ds1-5","1.61.0+ds1-6","1.62.0-1","1.62.0-2","1.62.0-3","1.63.0-1","1.64.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-containers-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.57.2+ds1-1","1.59.1+ds1-1","1.59.1+ds1-2","1.59.1+ds1-3","1.61.0+ds1-1","1.61.0+ds1-2","1.61.0+ds1-3","1.61.0+ds1-4","1.61.0+ds1-5","1.61.0+ds1-6","1.62.0-1","1.62.0-2","1.62.0-3","1.63.0-1","1.64.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-containers-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg1-2","1.13.2+dfsg1-3","1.13.5+dfsg1-1","1.15.1+dfsg1-1","1.15.2+dfsg1-1","1.15.3+dfsg1-1","1.15.5+dfsg1-1","1.15.7+dfsg1-1","1.15.8+dfsg1-1","1.15.8+dfsg1-1ubuntu1","1.15.8+dfsg1-1ubuntu2","1.15.8+dfsg1-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-github-containers-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31.3+ds1-1ubuntu1","1.36.0+ds1-2","1.36.0+ds1-2ubuntu0.1","1.36.0+ds1-2ubuntu0.1+esm1","1.36.0+ds1-2ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-containers-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.43.0+ds1-8build1","1.50.2+ds1-2","1.51.0+ds1-2","1.51.0+ds1-2ubuntu0.24.04.1","1.51.0+ds1-2ubuntu0.24.04.2","1.51.0+ds1-2ubuntu0.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-containers-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.61.0+ds1-6","1.62.0-3","1.63.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-containers-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.57.2+ds1-1","1.61.0+ds1-6"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.2-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2.1"}]}],"bundled":4}],"products":[{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat quay 3"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-79699","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523408","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79699","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p44w-25fh-fx4c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-79699","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-79699","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-79699","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-79699","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79699","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116587","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-79699","title":"Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T16:25:16.09Z","modified":"2026-11-06T19:43:04.367Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-06T20:30:05.028126Z"}],"euvd":[{"id":"EUVD-2026-78824","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T16:25:16Z","modified":"2026-11-06T19:43:04Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T21:07:00.111123Z"}],"ghsa":[{"id":"GHSA-p44w-25fh-fx4c","title":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious...","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T18:32:33Z","modified":"2026-09-15T18:32:43Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:11:54.818367Z"}],"nvd":[{"id":"CVE-2026-79699","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:27.083Z","modified":"2026-11-06T20:17:26.187Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-06T22:02:13.634375Z"}],"osv":[{"id":"ALPINE-CVE-2026-79699","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:27.083Z","modified":"2026-11-03T06:33:06.508114599Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-79699","status":"published","published":"2026-09-20T06:04:11.852912Z","modified":"2026-10-08T07:15:02.714225315Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"DEBIAN-CVE-2026-79699","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:27.083Z","modified":"2026-11-07T09:47:24.123561777Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"UBUNTU-CVE-2026-79699","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:00Z","modified":"2026-10-28T20:17:48.732534492Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"AZL-103062","title":"CVE-2026-79699 affecting package buildah 1.43.1-3","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:27Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103071","title":"CVE-2026-79699 affecting package cri-o 1.30.1-1","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:27Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103089","title":"CVE-2026-79699 affecting package podman 5.6.1-10","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:27Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103140","title":"CVE-2026-79699 affecting package containerized-data-importer 1.62.0-9","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:27Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103227","title":"CVE-2026-79699 affecting package libcontainers-common 20240213-3","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:27Z","modified":"2026-09-21T05:34:22Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103269","title":"CVE-2026-79699 affecting package skopeo 1.14.4-15","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:27Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-108396","title":"CVE-2026-79699 affecting package moby-engine 25.0.18-1","description":"A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.","status":"published","published":"2026-09-15T17:17:27Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"openSUSE-SU-2026:12068-1","title":"podman-6.1.2-1.1 on GA media","description":"These are all security issues fixed in the podman-6.1.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.380006842Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12478-1","title":"skopeo-1.24.0-2.1 on GA media","description":"These are all security issues fixed in the skopeo-1.24.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:17.482856144Z","updated_at":"2026-11-07T17:50:39.727056Z"}]}}