Executive brief
Podman is a tool for managing and running containers. A vulnerability in its 'kube play' command allows a malicious container to trick the system into overwriting sensitive files on the host computer. This could lead to system instability or unauthorized configuration changes, though the attacker cannot fully control the data being written.
Technical details
A symlink traversal vulnerability exists in the 'podman kube play' command (CWE-22, CWE-61). When a Kubernetes YAML file specifies a ConfigMap or Secret volume mount, Podman may follow a malicious symbolic link created within that volume during a previous run. An attacker with control over the container's volume can create a symlink pointing to a host file; upon a subsequent execution of 'kube play', Podman will follow the link and overwrite the host target. While the attacker controls the target path, the content written is restricted to what is defined in the user-provided YAML file. The issue is fixed in Podman v5.6.1.
Affected products
- containers podman/v4 <= 4.9.5
- containers podman/v5 <= 5.6.0
Timeline
- 2025-09-04: disclosed
- 2025-09-04: advisory
- 2025-09-04: patched: Fixed in v5.6.1