Most recent entries from all

bdu:2026-15353

BELL-CVE-2026-55686

Affected: Alpaquita:23: podman, Alpaquita:25: podman

EUVD-2026-330727

fkie_cve-2026-55686

Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.

GHSA-q6r4-3wmg-fwcq — Podman: WORKDIR symlink traversal vulnerability

Affected: Go: github.com/containers/podman/v5, Go: github.com/containers/podman/v4, Go: github.com/containers/podman/v3

### Summary

Running a malicous container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition.

### Patch

https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0

### Details

This issue was fixed in podman 5.7.1 (git commit 7ce2e00ab140c11a68301f0b161f51984131a858)

### PoC

The reproducer script _test1.bash_ demonstrates the vulnerability. The directory `/var/BREAKOUT` is created on the host. The container process uses the container directory `/var/BREAKOUT` as current working directory.

The reproducer script _test2.bash_ demonstrates the same vulnerability. The directory `/var/BREAKOUT` is created on the host. The container process uses the container directory `/usr/local` as current working directory.

The reproducer script _test2.bash_ shows that the working directory can be different from the breakout directory.

Reproducer **test1.bash**

``` #!/bin/bash set -o errexit set -o nounset

if [ -e /var/BREAKOUT ]; then echo error: path /var/BREAKOUT should not exist beforehand exit 1 fi

dir=$(mktemp -d) cat > $dir/Containerfile << 'EOF' FROM docker.io/library/alpine RUN cd / && ln -s ../../../../../../../var symlink USER 1234:1234 WORKDIR /symlink/BREAKO…

RHSA-2026:29954 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

github.com/containers/podman: Podman: Host filesystem modification via malicious container image WORKDIR symlink podman: Podman: Information disclosure via malicious container image environment variables

SUSE-SU-2026:23205-1 — Security update for podman

Security update for podman

UBUNTU-CVE-2026-55686

Affected: Ubuntu:25.10: podman, Ubuntu:26.04:LTS: podman

WID-SEC-W-2026-2104 — Podman: Schwachstelle ermöglicht Manipulation von Dateien

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Podman ausnutzen, um Dateien zu manipulieren.