CVE-2026-79705

Fixed in a distro release EPSS <1%CVSS 4.5

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

Published 2026-09-15 · CVE record · OSV

Products: Red Hat Hardened Images, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift Virtualization 4, Red Hat Quay 3

Distro releases