CVE-2025-11395

Awaiting Analysis Awaiting Analysis - Queue

Podman Tar Archive File Creation Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-29

Assigner: redhat-SADP

Description

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-29

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2025-11395

EUVD

EUVD-2025-210915

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	podman	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-277	A product defines a set of insecure permissions that are inherited by objects that are created by the program.

Attack-Flow Graph

Executive Summary

A flaw in Podman allows an attacker to create files on the host machine with the privileges of the user running Podman by passing a crafted tar archive to the podman load command.

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized file creation or modification on systems running Podman. Check for unexpected tar archives being processed by Podman commands like `podman load`. Review system logs for Podman-related activities and inspect file permissions in directories accessible to Podman users.

Impact Analysis

An attacker could exploit this to write malicious files on your system, potentially leading to unauthorized access, data theft, or further compromise of your environment.

Compliance Impact

This vulnerability could lead to unauthorized file creation, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA, resulting in compliance violations.

Mitigation Strategies

Immediately update Podman to the latest version to patch this flaw. Avoid using Podman with untrusted tar archives. Restrict user permissions to minimize potential impact. Monitor for suspicious file creation and review Podman command usage logs.

Hi! I’m here to help you understand CVE-2025-11395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70