CVE-2025-11395
Fixed in a distro release EPSS <1%CVSS 5.5
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | buildah | 2:1.43.1-7.el10_2 |
| AlmaLinux 10 | buildah-tests | 2:1.43.1-7.el10_2 |
| Debian 13 | podman | no fix |
| Debian 14 | podman | no fix |
| Red Hat Enterprise Linux 9 | buildah | 2:1.43.3-2.el9_8 |
| Red Hat Enterprise Linux 9 | buildah-debuginfo | 2:1.43.3-2.el9_8 |
| Red Hat Enterprise Linux 9 | buildah-debugsource | 2:1.43.3-2.el9_8 |
| Red Hat Enterprise Linux 9 | buildah-tests | 2:1.43.3-2.el9_8 |
| Red Hat Enterprise Linux 9 | buildah-tests-debuginfo | 2:1.43.3-2.el9_8 |
| Red Hat Enterprise Linux 9 | skopeo | 2:1.22.2-8.el9_8 |
| Red Hat Enterprise Linux 9 | skopeo-debuginfo | 2:1.22.2-8.el9_8 |
| Red Hat Enterprise Linux 9 | skopeo-debugsource | 2:1.22.2-8.el9_8 |
| Red Hat Enterprise Linux 9 | skopeo-tests | 2:1.22.2-8.el9_8 |
| Rocky Linux 10 | buildah | 2:1.43.1-7.el10_2 |
| Rocky Linux 9 | buildah | 2:1.43.3-2.el9_8 |
| Rocky Linux 9 | skopeo | 2:1.22.2-8.el9_8 |
| Ubuntu 26.04 LTS | podman | no fix |
| Ubuntu 26.10 | podman | no fix |
| openSUSE Tumbleweed | podman | 6.1.2-1.1 |