CVE-2025-9566
High
Description
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1
SeverityHigh
CVSS8.1
Exploit probability—
ProductGithub.com/containers/podman/v5
PublishedSep 5, 2025
First seenSep 5, 2025
Weakness typeCWE-22Path traversal
How to fix
Update
- github.com/containers/podman/v55.6.1 or later
Vendor advisories
- access.redhat.com/errata/RHBA-2025:15692
- access.redhat.com/errata/RHBA-2025:15712
- access.redhat.com/errata/RHBA-2025:16131
- access.redhat.com/errata/RHBA-2025:16158
- access.redhat.com/errata/RHBA-2025:16163
- access.redhat.com/errata/RHBA-2025:18215
- access.redhat.com/errata/RHEA-2025:4782
- access.redhat.com/errata/RHSA-2025:15900
- access.redhat.com/errata/RHSA-2025:15901
- access.redhat.com/errata/RHSA-2025:15904
- access.redhat.com/errata/RHSA-2025:16480
- access.redhat.com/errata/RHSA-2025:16481
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/containers/podman/v5Go | v < 5.6.1, v ≤ 5.6.0 | 5.6.1 |
| github.com/containers/podman/v4Go | v ≤ 4.9.5, No range specified | — |
| github.com/containers/podmanGo | No range specified | — |
| github.com/containers/podman/v2Go | No range specified | — |
| github.com/containers/podman/v3Go | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.