CVE-2026-79705
Received Received - Intake

Path Traversal in Buildah Copier Go Package

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: redhat-SADP

Description
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-79705
EUVD
EUVD-2026-78823

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat buildah *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79705 is a directory escape vulnerability in the buildah/copier Go package. It occurs when a crafted tar archive containing malicious symlinks is used outside of Buildah by a non-root caller. This allows files to be created outside the intended extraction directory.

Detection Guidance

To detect this vulnerability, monitor for unusual file creation outside intended directories during podman cp operations. Check for unexpected symlinks in tar archives used with Podman. Review Podman service logs for suspicious activity involving file operations.

Impact Analysis

The vulnerability can impact users of macOS Podman remote clients performing podman cp against a malicious Podman system service server. It enables file creation outside the intended directory, potentially leading to unauthorized file modification or creation on the system.

Mitigation Strategies

Only perform podman cp operations against trusted servers. Avoid using Podman remote clients on macOS with untrusted systems. Monitor for unauthorized file modifications. Apply patches once available from Podman/Buildah maintainers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79705. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart