CVE-2026-79705 — Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target e…
Published: 2026-09-15 · CVSS: 4.5 · CVSS 3.1
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7