# CVE-2025-11395: Podman path traversal in tar archive handling

Source: https://junglewise.ai/threats/cve-2025-11395-podman-path-traversal-in-tar-archive-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2025-11395 · Severity: medium · CVSS 5.5 · Published 2026-09-15

Podman is a container runtime tool used to run and manage containerized applications. A flaw in the `podman load` command allows an attacker to create files on the host machine with the privileges of the user running Podman by providing a specially crafted tar archive, potentially leading to unauthorized file modification or privilege escalation on the host system.

## Quick answers

**Is CVE-2025-11395 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-11395 being exploited in the wild.

**How severe is CVE-2025-11395?** Medium severity, with a CVSS score of 5.5, published 15 September 2026.

**Which products and versions are affected?** Podman Project Podman.

**Is there a fix for CVE-2025-11395?** A patch was published on 2026-09-23: Fix available in buildah package updates Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-11395 attacked?** It is attacked over the network or with local access, in a network appliance.

**Am I affected by CVE-2025-11395?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in Podman's `podman load` command when processing tar archives. An attacker can craft a malicious tar file containing relative or absolute path sequences (such as symlinks or directory traversal patterns) that, when extracted, create or overwrite files outside the intended container directory on the host. The vulnerability requires the attacker to provide the tar archive as input to `podman load`, but does not require authentication. An exploited vulnerability allows arbitrary file creation/modification on the host filesystem with the privileges of the user running the Podman daemon. A patch is available.

## Affected products

- Podman Project Podman

## Timeline

- 2026-09-15: disclosed
- 2026-09-23: patched: Fix available in buildah package updates

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2026:70640](https://access.redhat.com/errata/RHSA-2026:70640)