Description
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Podman | podman | fixed in 1.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Other 7 | podman +1 | 1.4.4-2.el7 | RHSA-2019:1907 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | fuse-overlayfs | 0.4.1-3.3.8 | SUSE-SU-2019:2223-1 |
| SLES 15 SP1 | fuse3 | 3.6.1-3.3.8 | SUSE-SU-2019:2223-1 |
| SLES 15 SP1 | libcontainers-common | 20190401-3.3.5 | SUSE-SU-2019:2223-1 |
| SLES 15 SP1 | podman | 1.4.4-4.8.1 | SUSE-SU-2019:2223-1 |
| SLES 15 SP1 | slirp4netns | 0.3.0-3.3.3 | SUSE-SU-2019:2223-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libcontainers-common | 20210626-5.1 | openSUSE-SU-2024:10931-1 |
| openSUSE Tumbleweed | podman | 3.3.1-2.1 | openSUSE-SU-2024:11177-1 |
| openSUSE Leap 15.1 | fuse-overlayfs | 0.4.1-lp151.2.1 | openSUSE-SU-2019:2044-1 |
| openSUSE Leap 15.1 | fuse3 | 3.6.1-lp151.2.1 | openSUSE-SU-2019:2044-1 |
| openSUSE Leap 15.1 | libcontainers-common | 20190401-lp151.2.3.1 | openSUSE-SU-2019:2044-1 |
| openSUSE Leap 15.1 | podman | 1.4.4-lp151.3.3.1 | openSUSE-SU-2019:2044-1 |
| openSUSE Leap 15.1 | slirp4netns | 0.3.0-lp151.2.3.1 | openSUSE-SU-2019:2044-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/containers/podman | < 1.4.0 | 1.4.0 | GHSA-rh5f-2w6r-q7vj |
Advisories 5
- RHSA-2019:1907 Red Hat Security Advisory: podman security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Feb 21, 2026
- openSUSE-SU-2019:2044-1 Security update for podman, slirp4netns and libcontainers-common SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10931-1 libcontainers-common-20210626-5.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2223-1 Security update for podman, slirp4netns and libcontainers-common SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11177-1 podman-3.3.1-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026