Podman: podman kube play command may overwrite host files

Summary

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1

Timeline

1. Sep 5, 2025, 7:54 PM UTCCVE published
2. Sep 5, 2025, 8:16 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 8, 2026, 8:56 PM UTCRecord last updated

Affected versions

• podman

  From 4.0.0 · fixed in 5.6.1

• podman

  Version range not reported

• container-tools:rhel8

  Version range not reported

• container-tools:rhel8

  Version range not reported

• container-tools:rhel8

  Version range not reported

• container-tools:rhel8

  Version range not reported

• container-tools:rhel8

  Version range not reported

• container-tools:rhel8

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• container-selinux

  Version range not reported

• cri-o

  Version range not reported

• kernel

  Version range not reported

• openshift

  Version range not reported

• openshift-ansible

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• container-selinux

  Version range not reported

• cri-o

  Version range not reported

• openshift

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• podman-main

  Version range not reported

• devspaces/udi-base-rhel9

  Version range not reported

• devspaces/udi-rhel9

  Version range not reported

• github.com/containers/podman/v5Go

  fixed in 5.6.1

• github.com/containers/podman/v4Go

  through 4.9.5

• github.com/containers/podmanGo

  All versions

• github.com/containers/podman/v2Go

  All versions

• github.com/containers/podman/v3Go

  All versions

• github.com/containers/podman/v4Go

  All versions

References 25