Executive brief
buildah/copier is a Go library used by container tools like Podman to extract tar archives. A flaw allows attackers to craft malicious tar files containing symlinks that escape the intended extraction directory and create files outside it. While Buildah itself is protected by chroot hardening, applications using the library directly—such as Podman running on macOS—can be exploited by a malicious server, potentially overwriting files and compromising system integrity.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the buildah/copier Go package that improperly validates symlinks in tar archives. When the library is used outside of Buildah by non-root callers, an attacker can craft a tar archive containing malicious symlinks to escape the target extraction directory. The attack vector is network-based and requires high privileges (a controlled server) and user interaction (initiating a copy operation). An attacker can create or overwrite arbitrary files on the victim's filesystem. Buildah itself is unaffected because it uses chroot isolation, but other consumers of the library—notably the Podman remote client on macOS performing podman cp operations—are vulnerable. Patches are available from Red Hat.
Affected products
- Red Hat buildah/copier <UNKNOWN>
- Red Hat Podman <UNKNOWN>
Timeline
- 2026-09-15: disclosed: CVE-2026-79705 published