All vulnerabilities
CVE-2025-9566GHSA-wp3j-xq48-xpjwGO-2025-3935

github.com/containers/podman/v5: podman kube play symlink traversal vulnerability

github.com/containers/podman/v5goLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.16%Chance of exploitation activity in the next 30 days, higher than 66% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.6.1Fixed versionGitHub
Published5 Sep 2025Updated 8 Oct 2026CVE List

What fixes it

  • 5.6.1github.com/containers/podman/v5, goGitHubgo get github.com/containers/podman/v5@v5.6.1
  • 5.6.1CVE List
  • 5.6.1github.com/containers/podman/v5, GoOSVgo get github.com/containers/podman/v5@v5.6.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

The podman kube play command can overwrite host files when the kube file contains a ConfigMap or Secret volume mount and the volume already contains a symlink to a host file. This allows a malicious container to write to arbitrary files on the host BUT the attacker only controls the target path not the contents that will be written to the file. The contents are defined in the yaml file by the end user.

Requirements to exploit:

podman kube play must be used with a ConfigMap or Secret volume mount AND must be run more than once on the same volume. All the attacker has to do is create the malicious symlink on the volume the first time it is started. After that all following starts would follow the symlink and write to the host location.

Patches

Fixed in podman v5.6.1 https://github.com/containers/podman/commit/43fbde4e665fe6cee6921868f04b7ccd3de5ad89

Workarounds

Don't use podman kube play with ConfigMap or Secret volume mounts.

PR with test for CI

Adding on 9/8/2025 by @TomSweeneyRedHat , this is the PR containing the test in CI: https://github.com/containers/podman/pull/27001

Text from GitHub Advisory Database

Affected versions 44

  • github.com/containers/podman/v5, go<= 5.6.0GitHub
  • github.com/containers/podman/v4, go<= 4.9.5GitHub
  • Productaffected: 4.0.0 before 5.6.1CVE List
  • Red Hat Enterprise Linux 10unaffected: 6:5.4.0-13.el10_0 and laterCVE List
  • Red Hat Enterprise Linux 10unaffected: 7:5.6.0-5.el10_1 and laterCVE List
  • Red Hat Enterprise Linux 10unaffected: 7:5.8.0-2.el10 and laterCVE List
  • Red Hat Enterprise Linux 8unaffected: 8100020250911075811.afee755d and laterCVE List
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected: 8060020250919150821.3b538bd8 and laterCVE List
  • Red Hat Enterprise Linux 8.6 Telecommunications Update Serviceunaffected: 8060020250919150821.3b538bd8 and laterCVE List
  • Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionsunaffected: 8060020250919150821.3b538bd8 and laterCVE List
  • Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceunaffected: 8080020250919060528.0f77c1b7 and laterCVE List
  • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected: 8080020250919060528.0f77c1b7 and laterCVE List
  • Red Hat Enterprise Linux 9unaffected: 5:5.4.0-13.el9_6 and laterCVE List
  • Red Hat Enterprise Linux 9unaffected: 6:5.6.0-6.el9_7 and laterCVE List
  • Red Hat Enterprise Linux 9unaffected: 6:5.8.0-1.el9 and laterCVE List
  • Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected: 2:4.2.0-6.el9_0.5 and laterCVE List
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected: 2:4.4.1-22.el9_2.4 and laterCVE List
  • Red Hat Enterprise Linux 9.4 Extended Update Supportunaffected: 4:4.9.4-18.el9_4.3 and laterCVE List
  • Red Hat OpenShift Container Platform 4.12unaffected: 412.86.202510291903-0 and laterCVE List
  • Red Hat OpenShift Container Platform 4.13unaffected: 413.92.202510150118-0 and laterCVE List
  • Red Hat OpenShift Container Platform 4.14unaffected: 0:5.14.0-284.138.1.el9_2 and laterCVE List
  • Red Hat OpenShift Container Platform 4.14unaffected: 0:5.14.0-284.138.1.rt14.423.el9_2 and laterCVE List
  • Red Hat OpenShift Container Platform 4.14unaffected: 3:4.4.1-23.rhaos4.14.el8 and laterCVE List
  • Red Hat OpenShift Container Platform 4.14unaffected: 414.92.202510211419-0 and laterCVE List
  • Red Hat OpenShift Container Platform 4.15unaffected: 0:5.14.0-284.138.1.el9_2 and laterCVE List
  • Red Hat OpenShift Container Platform 4.15unaffected: 0:5.14.0-284.138.1.rt14.423.el9_2 and laterCVE List
  • Red Hat OpenShift Container Platform 4.15unaffected: 3:4.4.1-35.rhaos4.15.el8 and laterCVE List
  • Red Hat OpenShift Container Platform 4.15unaffected: 415.92.202609140326-0 and laterCVE List
  • Red Hat OpenShift Container Platform 4.16unaffected: 416.94.202609011112-0 and laterCVE List
  • Red Hat OpenShift Container Platform 4.17unaffected: 417.94.202510112152-0 and laterCVE List
  • Red Hat OpenShift Container Platform 4.18unaffected: 4:2.237.0-1.rhaos4.18.el9 and laterCVE List
  • Red Hat OpenShift Container Platform 4.18unaffected: 0:1.31.12-3.rhaos4.18.gitdc59c78.el8 and laterCVE List
  • Red Hat OpenShift Container Platform 4.18unaffected: 0:5.14.0-427.87.1.el9_4 and laterCVE List
  • Red Hat OpenShift Container Platform 4.18unaffected: 0:4.18.0-202509090932.p2.ga4cad44.assembly.stream.el8 and laterCVE List
  • Red Hat OpenShift Container Platform 4.18unaffected: 0:4.18.0-202509011551.p2.g018e43a.assembly.stream.el8 and laterCVE List
  • Red Hat OpenShift Container Platform 4.18unaffected: 5:5.2.2-11.rhaos4.18.el9 and laterCVE List
  • Red Hat OpenShift Container Platform 4.18unaffected: 418.94.202510230424-0 and laterCVE List
  • Red Hat OpenShift Container Platform 4.19unaffected: 4:2.237.0-1.rhaos4.19.el9 and laterCVE List
  • Red Hat OpenShift Container Platform 4.19unaffected: 0:1.32.8-3.rhaos4.19.git60d4e21.el9 and laterCVE List
  • Red Hat OpenShift Container Platform 4.19unaffected: 0:4.19.0-202509070341.p2.gb5229e8.assembly.stream.el9 and laterCVE List
  • Red Hat OpenShift Container Platform 4.19unaffected: 5:5.4.0-7.rhaos4.19.el9 and laterCVE List
  • Red Hat OpenShift Container Platform 4.19unaffected: 4.19.9.6.202510140714-0 and laterCVE List
  • github.com/containers/podman/v5, Gofrom first release, fixed in 5.6.1OSV
  • github.com/containers/podman/v4, Gofrom first release, through 4.9.5OSV

References 36