CVE-2025-4953: Podman data persistence in bind mounts during build

CVE-2025-4953 · Severity: high · CVSS 7.4 · Published 2025-09-16

A security flaw was identified in Podman, a tool used for managing and building software containers. During the container building process, certain temporary data that should be discarded is instead saved to the host computer's temporary directories. This could allow sensitive files created inside a container during its build phase to be accessed by unauthorized users or processes on the host system.

Technologies: github.com/containers/podman (Go), github.com/containers/podman/v2 (Go), github.com/containers/podman/v3 (Go), github.com/containers/podman/v4 (Go), github.com/containers/podman/v5 (Go), Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4.12. Vendors: Go, Red Hat.

Quick answers

Is CVE-2025-4953 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-4953 being exploited in the wild.
How severe is CVE-2025-4953?
High severity, with a CVSS score of 7.4, published 16 September 2025.
Which products and versions are affected?
github.com/containers/podman (Go) SEMVER:introduced=0; github.com/containers/podman/v2 (Go) SEMVER:introduced=0; github.com/containers/podman/v3 (Go) SEMVER:introduced=0; github.com/containers/podman/v4 (Go) SEMVER:introduced=0; and 4 more.
Is there a fix for CVE-2025-4953?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-4953 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-4953?
Check whether you run github.com/containers/podman (Go), github.com/containers/podman/v2 (Go), github.com/containers/podman/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Podman where data written to 'RUN --mount=type=bind' mounts during a 'podman build' operation is not properly discarded. This root cause leads to files created within the container environment persisting in the temporary build context directory on the host machine. An attacker with access to the host's temporary directories could retrieve sensitive information or files generated during the build process. The issue is categorized as an insecure temporary file creation (CWE-378). Patches have been released across various Red Hat products and the upstream Podman repository (commit 50295e5e5d1a4583d26d5c6d5c0608cff498cc8d).

Affected products

  • Red Hat Podman All versions prior to commit 50295e5e5d1a4583d26d5c6d5c0608cff498cc8d
  • Red Hat Red Hat Enterprise Linux 8 container-tools:rhel8 prior to 8100020250911075811.afee755d
  • Red Hat Red Hat OpenShift Container Platform 4.12 podman prior to 3:4.2.0-15.rhaos4.12.el9
  • Red Hat Red Hat OpenShift Container Platform 4.13 buildah prior to 1:1.29.1-5.rhaos4.13.el9

Identifiers

  • CVE-2025-4953
  • GHSA-m68q-4hqr-mc6f
  • GO-2025-3961

Timeline

  • 2024-11-06: advisory: Initial Red Hat advisory (RHSA-2024:8690) published
  • 2025-09-16: disclosed: CVE-2025-4953 details published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.