CVE-2026-79705— Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers
Quick assessment
Affected
Red Hat Red Hat Ansible Automation Platform 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Go 包中发现了一个安全漏洞。当该包被非 root 用户在 Buildah 之外调用时，攻击者可能构造一个包含恶意符号链接（symlink）的 tar 归档文件，从而逃逸出目标解压目录，并在预期的目标位置之外创建文件。Buildah 本身使用了 chroot 加固机制，因此不受此漏洞影响。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79705
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Dev Spaces | - |
cpe:/a:redhat:openshift_devspaces:3
|
|
| Red Hat | Red Hat OpenShift Dev Spaces | - |
cpe:/a:redhat:openshift_devspaces:3
|
|
II. Public POCs for CVE-2026-79705
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79705
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-79705 (1)
Other References for CVE-2026-79705 (1)
Same Patch Batch · Red Hat · 2026-09-15 · 9 CVEs total
| CVE-2026-85234 | 7.5 HIGH | Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine |
| CVE-2026-85013 | 7.3 HIGH | Environment-modules: command injection in environment-modules bash completion via maliciou |
| CVE-2026-75092 | 7.3 HIGH | Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld |
| CVE-2026-81303 | 6.3 MEDIUM | Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostnam |
| CVE-2026-91786 | 6.1 MEDIUM | Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvali |
| CVE-2026-81320 | 5.5 MEDIUM | Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level |
| CVE-2026-79699 | 4.4 MEDIUM | Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacem |
| CVE-2026-91926 | 3.7 LOW | Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair en |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2
-
CVE-2026-79699
Podman: buildah: skopeo: containers/storage: malicious tar w -
CVE-2026-84185
Jwcrypto: jwcrypto: general json jws kid binding bypass duri -
CVE-2026-84470
Automation-controller: automation-controller-container: auto -
CVE-2026-84232
Pulpcore: python-pulpcore: stored cross-site scripting via i -
CVE-2026-80179
Jwcrypto: jwcrypto: denial of service via malformed jwe toke
Same vendor: Red Hat
-
CVE-2026-85234
Tftp: tftp-hpa: denial of service due to out-of-bounds read/ -
CVE-2026-79699
Podman: buildah: skopeo: containers/storage: malicious tar w -
CVE-2026-85013
Environment-modules: command injection in environment-module -
CVE-2026-91926
Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_ -
CVE-2026-91786
Gnome-shell: gnome-shell: out-of-bounds read in remote searc
Same weakness: CWE-22
-
CVE-2026-81568
Joomla Extension - j2commerce.com - Arbitrary file read via -
CVE-2026-57442
MCPVault: PathFilter restricted directories (.git/.obsidian/ -
CVE-2026-48785
Apptainer: Incorrect path matching for 'limit container path -
CVE-2026-54561
MCP Memory Keeper: Arbitrary local file read in mcp-memory-k -
CVE-2026-91989
atomic-agents-stack before 1.1.0 Path Traversal via dashboar
V. Comments for CVE-2026-79705
No comments yet