Is CVE-2025-9566 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-9566 being exploited in the wild.

How severe is CVE-2025-9566?

High severity, with a CVSS score of 8.1, published 5 September 2025.

Which products and versions are affected?

Containers Podman <= 4.9.5, v4.0.0 to v5.6.0; github.com/containers/podman (Go) SEMVER:introduced=0; github.com/containers/podman/v2 (Go) SEMVER:introduced=0; github.com/containers/podman/v3 (Go) SEMVER:introduced=0; and 2 more.

Is there a fix for CVE-2025-9566?

Yes. github.com/containers/podman/v5 (Go): upgrade to 5.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-9566 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-9566?

Check whether you run Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-9566: Podman path traversal host file overwrite in kube play

Q: Which products and versions are affected?

Containers Podman <= 4.9.5, v4.0.0 to v5.6.0; github.com/containers/podman (Go) SEMVER:introduced=0; github.com/containers/podman/v2 (Go) SEMVER:introduced=0; github.com/containers/podman/v3 (Go) SEMVER:introduced=0; and 2 more.

Q: Is there a fix for CVE-2025-9566?

Yes. github.com/containers/podman/v5 (Go): upgrade to 5.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-9566 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-9566?

Check whether you run Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-9566 · Severity: high · CVSS 8.1 · Published 2025-09-05

Podman is a tool for managing and running containers. A vulnerability in its 'kube play' command allows a malicious container to trick the system into overwriting sensitive files on the host computer. This could lead to system instability or unauthorized configuration changes, though the attacker cannot fully control the data being written.

Technologies: Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go), github.com/containers/podman/v3 (Go), github.com/containers/podman/v4 (Go), github.com/containers/podman/v5 (Go). Vendors: Containers, Go.

Quick answers

Is CVE-2025-9566 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-9566 being exploited in the wild.
How severe is CVE-2025-9566?: High severity, with a CVSS score of 8.1, published 5 September 2025.
Which products and versions are affected?: Containers Podman <= 4.9.5, v4.0.0 to v5.6.0; github.com/containers/podman (Go) SEMVER:introduced=0; github.com/containers/podman/v2 (Go) SEMVER:introduced=0; github.com/containers/podman/v3 (Go) SEMVER:introduced=0; and 2 more.
Is there a fix for CVE-2025-9566?: Yes. github.com/containers/podman/v5 (Go): upgrade to 5.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-9566 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-9566?: Check whether you run Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/containers/podman/v5 (Go): upgrade to 5.6.1 or later
```
go get github.com/containers/podman/v5@v5.6.1
```

Technical details

A symlink traversal vulnerability exists in the 'podman kube play' command (CWE-22, CWE-61). When a Kubernetes YAML file specifies a ConfigMap or Secret volume mount, Podman may follow a malicious symbolic link created within that volume during a previous run. An attacker with control over the container's volume can create a symlink pointing to a host file; upon a subsequent execution of 'kube play', Podman will follow the link and overwrite the host target. While the attacker controls the target path, the content written is restricted to what is defined in the user-provided YAML file. The issue is fixed in Podman v5.6.1.

Affected products

containers podman/v4 <= 4.9.5
containers podman/v5 <= 5.6.0

Identifiers

CVE-2025-9566
GHSA-wp3j-xq48-xpjw
GO-2025-3935

Timeline

2025-09-04: disclosed
2025-09-04: advisory
2025-09-04: patched: Fixed in v5.6.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.