CVE-2026-79699
Received Received - Intake

Path Traversal in containers/storage Library

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: redhat-SADP

Description
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-79699
EUVD
EUVD-2026-78824

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat containers_storage *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a flaw in the containers/storage library where a specially crafted tar archive with a malicious whiteout header (e.g., victim/.wh.) can replace the extraction destination directory with an arbitrary file during operations like UnpackLayer, ApplyLayer, or ApplyUncompressedLayer. This affects applications using the library API directly.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual tar archive processing or directory replacement attempts. Check logs for applications using containers/storage library for errors related to UnpackLayer, ApplyLayer, or ApplyUncompressedLayer functions. Look for patterns like victim/.wh. in tar archives or unexpected file modifications during extraction.

Impact Analysis

Exploitation could allow file system traversal, reading or modifying unexpected files, or bypassing security mechanisms. Attackers could overwrite or replace intended directories with malicious content, potentially leading to unauthorized access or data manipulation.

Mitigation Strategies

Immediately stop processing untrusted tar archives in applications using containers/storage library. Monitor for suspicious file system changes. Since no official fixes are available, consider isolating affected systems or using alternative tools until patches are released. Regularly check for updates from Red Hat or upstream projects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79699. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart