CVE-2026-79705

Summary

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Workarounds

To mitigate this issue, users should ensure that podman cp operations are only performed against trusted Podman system service servers. Copying content from untrusted sources may expose the client to directory traversal vulnerabilities.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References