Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Two more Podman releases dropped! Podman v6.1.2 (https://github.com/podman-container-tools/podman/releases/tag/v6.1.2) and v5.8.7 (https://github.com/podman-container-tools/podman/releases/tag/v5.8.7). Both address 3 CVEs: CVE-2025-11395, CVE-2026-79699, and CVE-2026-79705. #podman #opensource