Most recent entries from all

EUVD-2026-337339

fkie_cve-2026-33414

Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is exclusive to the HyperV backend. This issue has been patched in version 5.8.2.

GHSA-hc8w-h2mf-hp59 — PowerShell Command Injection in Podman HyperV Machine

Affected: Go: github.com/containers/podman/v4, Go: github.com/containers/podman/v5

## Summary

A command injection vulnerability exists in Podman's HyperV machine backend. The VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing `$()` subexpression injection.

## Affected Code

**File**: `pkg/machine/hyperv/stubber.go:647`

```go resize := exec.Command("powershell", []string{ "-command", fmt.Sprintf("Resize-VHD \"%s\" %d", imagePath.GetPath(), newSize.ToBytes()), }...) ```

## Root Cause

PowerShell evaluates `$()` subexpressions inside double-quoted strings before executing the outer command. The `fmt.Sprintf` call places the user-controlled image path directly into double quotes without escaping or sanitization.

## Impact

An attacker who can control the VM image path (through a crafted machine name or image directory) can execute arbitrary PowerShell commands with the privileges of the Podman process on the Windows host. On typical Windows installations, this means SYSTEM-level code execution.

## Patch

https://github.com/containers/podman/commit/571c842bd357ee626019ea97d030fb772fc654ed

The affected code is only used on Windows, all other operating systems are not affected by this and can thus ignore the CVE patch.

## Credit

We like to thank Sang-Hoon Choi (@KoreaSecurity) for reporting this issue to us.

openSUSE-SU-2026:10706-1 — podman-5.8.2-1.1 on GA media

podman-5.8.2-1.1 on GA media

RHSA-2026:8211 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

podman: Podman kube play command may overwrite host files podman: github.com/containers/podman: Podman: Arbitrary code execution via command injection in HyperV backend

UBUNTU-CVE-2026-33414

Affected: Ubuntu:25.10: podman, Ubuntu:26.04:LTS: podman

WID-SEC-W-2026-1115 — Podman HyperV Machine: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten

Ein lokaler Angreifer kann eine Schwachstelle in Podman HyperV Machine ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.