There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.
Binary-Affected: podman
Upstream-version-introduced: v4.0.0
Upstream-version-fixed: v5.6.1
References
Configurations
No configuration.
History
13 Nov 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
11 Nov 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
11 Nov 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2025-09-05 20:15
Updated : 2025-11-13 10:15
NVD link : CVE-2025-9566
Mitre link : CVE-2025-9566
CVE.ORG link : CVE-2025-9566
JSON object : View
Products Affected
No product.
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')