CVE-2026-79705: Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Severity: medium (CVSS 4.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-15 · updated 2026-10-30
Weakness: CWE-22

Description

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

Affected products

Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Quay 3: all versions
Red Hat Ansible Automation Platform 2: all versions
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions
Red Hat Hardened Images: all versions — fixed in 6.1.3-1.hum1
Red Hat OpenShift Container Platform 5: all versions
Red Hat OpenShift Dev Spaces: all versions
Red Hat OpenShift Virtualization 4: all versions

How to fix

Upgrade to a fixed version: Red Hat Hardened Images 6.1.3-1.hum1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-79705 or the next vulnerability affects your stack