{"id":"CVE-2026-79705","aliases":["ALPINE-CVE-2026-79705","AZL-103065","AZL-103091","AZL-103230","BELL-CVE-2026-79705","DEBIAN-CVE-2026-79705","EUVD-2026-78823","GHSA-fmxx-r7q4-v8m6","RHSA-2026:74861","UBUNTU-CVE-2026-79705"],"status":"published","title":"Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","severity":{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00408,"percentile":0.354,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-09-15T16:23:26Z","modified":"2026-11-06T01:17:52Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"podman","fixed_in":["5.8.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"buildah","fixed_in":["1.45.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"podman","fixed_in":["6.1.3-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.8-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcontainers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240213-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.0-r0"},{"fixed":"1.45.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-r1"},{"fixed":"6.1.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.2+ds1-3","1.28.2+ds1-3+deb12u1","1.29.0+ds1-1","1.30.0+ds1-1","1.30.0+ds1-2","1.30.0+ds1-3","1.31.2+ds1-1","1.31.2+ds1-2","1.31.2+ds1-3","1.32.0+ds1-1","1.32.0+ds1-2","1.32.2+ds1-1","1.33.1+ds1-1","1.33.1+ds1-2","1.33.3+ds1-1","1.33.3+ds1-2","1.33.5+ds1-3","1.33.5+ds1-4","1.33.7+ds1-1","1.34.0+ds1-1","1.34.0+ds1-2","1.35.3+ds1-1","1.35.3+ds1-2","1.35.3+ds1-3","1.37.0+ds1-1","1.37.1+ds1-1","1.37.1+ds1-2","1.37.2+ds1-1","1.37.2+ds1-2","1.37.2+ds1-3","1.37.3+ds1-1","1.37.3+ds1-2","1.37.3+ds1-3","1.37.4+ds1-1","1.37.5+ds1-1","1.38.0+ds1-1","1.38.0+ds1-2","1.38.1+ds1-1","1.39.0+ds1-1","1.39.3+ds1-1","1.41.4+ds1-1","1.41.4+ds1-2","1.41.4+ds1-3","1.41.5+ds1-1","1.41.5+ds1-2","1.41.5+ds1-3","1.41.5+ds1-4","1.42.1+ds1-1","1.42.1+ds1-2","1.43.0+ds1-1","1.43.0+ds1-2","1.43.1+ds1-1","1.43.1+ds1-2","1.43.1+ds1-3","1.43.2+ds1-1","1.43.2+ds1-2","1.43.2+ds1-3","1.45.0+ds1-1","1.45.0+ds1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39.3+ds1-1","1.41.4+ds1-1","1.41.4+ds1-2","1.41.4+ds1-3","1.41.5+ds1-1","1.41.5+ds1-2","1.41.5+ds1-3","1.41.5+ds1-4","1.42.1+ds1-1","1.42.1+ds1-2","1.43.0+ds1-1","1.43.0+ds1-2","1.43.1+ds1-1","1.43.1+ds1-2","1.43.1+ds1-3","1.43.2+ds1-1","1.43.2+ds1-2","1.43.2+ds1-3","1.45.0+ds1-1","1.45.0+ds1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39.3+ds1-1","1.41.4+ds1-1","1.41.4+ds1-2","1.41.4+ds1-3","1.41.5+ds1-1","1.41.5+ds1-2","1.41.5+ds1-3","1.41.5+ds1-4","1.42.1+ds1-1","1.42.1+ds1-2","1.43.0+ds1-1","1.43.0+ds1-2","1.43.1+ds1-1","1.43.1+ds1-2","1.43.1+ds1-3","1.43.2+ds1-1","1.43.2+ds1-2","1.43.2+ds1-3","1.45.0+ds1-1","1.45.0+ds1-2"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.3-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.3-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podman-machine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.3-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.3-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"podmansh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.3-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3+ds1-1ubuntu1","1.23.1+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.2+ds1-3build1","1.32.2+ds1-1","1.33.1+ds1-2","1.33.3+ds1-2","1.33.5+ds1-4","1.33.5+ds1-4build1","1.33.5+ds1-4build2","1.33.7+ds1-1","1.33.7+ds1-1ubuntu0.24.04.1","1.33.7+ds1-1ubuntu0.24.04.2","1.33.7+ds1-1ubuntu0.24.04.2+esm1","1.33.7+ds1-1ubuntu0.24.04.2+esm2","1.33.7+ds1-1ubuntu0.24.04.3","1.33.7+ds1-1ubuntu0.24.04.3+esm2","1.33.7+ds1-1ubuntu0.24.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.42.1+ds1-2build1","1.43.2+ds1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39.3+ds1-1syncable1","1.42.1+ds1-2","1.42.1+ds1-2build1","1.42.1+ds1-2ubuntu0.26.04.1~esm1"]}],"products":[{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat quay 3"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:74861","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-79705","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523419","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79705","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fmxx-r7q4-v8m6"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-79705","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-79705","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-79705","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94603","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56851","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74861.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","tags":["advisory"]},{"url":"https://go.dev/cl/793360","tags":["article"]},{"url":"https://go.dev/issue/80112","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6629","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79705","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94603","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94603","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-79705","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-79705","title":"Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","status":"published","published":"2026-09-15T16:23:26.652Z","modified":"2026-11-06T00:55:01.018Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-06T01:55:46.939755Z"}],"euvd":[{"id":"EUVD-2026-78823","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","status":"published","published":"2026-09-15T16:23:26Z","modified":"2026-11-06T00:55:01Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"ghsa":[{"id":"GHSA-fmxx-r7q4-v8m6","title":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root...","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","status":"published","published":"2026-09-15T18:32:33Z","modified":"2026-10-02T15:32:15Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:12:43.646433Z"}],"nvd":[{"id":"CVE-2026-79705","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","status":"published","published":"2026-09-15T17:17:27.313Z","modified":"2026-11-06T01:17:52.92Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-06T06:59:05.303911Z"}],"osv":[{"id":"ALPINE-CVE-2026-79705","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","status":"published","published":"2026-09-15T17:17:27.313Z","modified":"2026-11-03T06:33:06.508140681Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-79705","status":"published","published":"2026-09-20T06:04:11.91206Z","modified":"2026-10-08T07:15:05.45216372Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"DEBIAN-CVE-2026-79705","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","status":"published","published":"2026-09-15T17:17:27.313Z","modified":"2026-10-31T09:47:30.243114994Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:04.001673Z"},{"id":"RHSA-2026:74861","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-03T10:16:59Z","modified":"2026-10-20T10:43:37.886939415Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-79705","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","status":"published","published":"2026-09-15T17:17:00Z","modified":"2026-10-28T20:17:05.841041354Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"AZL-103065","title":"CVE-2026-79705 affecting package buildah 1.43.1-3","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","status":"published","published":"2026-09-15T17:17:27Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103091","title":"CVE-2026-79705 affecting package podman 5.6.1-10","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","status":"published","published":"2026-09-15T17:17:27Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103230","title":"CVE-2026-79705 affecting package libcontainers-common 20240213-3","description":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.","status":"published","published":"2026-09-15T17:17:27Z","modified":"2026-09-21T05:34:22Z","updated_at":"2026-11-02T15:28:00.794214Z"}]}}