6.1medium
Local file overwrite by extracting a malicious tar archive
Fixed in: go.podman.io/image/v5 5.39.3 / 5.41.2; go.podman.io/storage 1.62.1 / 1.64.1
patched
details
- Finding IDs
- F-PODMAN-001-007
- CVE
- CVE-2025-11395
- GHSA
- GHSA-3gcv-x57j-xqxv
- Status
- patched
- Fixed in
- go.podman.io/image/v5 5.39.3 / 5.41.2; go.podman.io/storage 1.62.1 / 1.64.1
- Recorded credit
- reporter: Oleh Konko / @1seal (alongside other reporters)
- Note
- GHSA-3gcv-x57j-xqxv: malicious tar extraction can overwrite local files or change their attributes through podman load, oci-archive references, podman volume import, and storage/pkg/archive consumers. Registry image pulls are unaffected. Legacy github.com/containers/image/v5 and github.com/containers/storage modules have no patched versions; migrate to go.podman.io modules. Internal finding mapping is based on the reported volume-import path and shared archive extractor; the vendor advisory does not name internal finding IDs.
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
- CVE registry state
- PUBLISHED
- CVE state checked
- CVSS assessment
- Container libraries (repository advisory); v3.1; 6.1; observed 2026-09-24
- Upstream title
- Local file overwrite by extracting a malicious tar archive
- Upstream publication
- Upstream updated
- Metadata fetched
- Upstream @1seal credit
- @1seal: reporter (accepted)
F-PODMAN-001-007: File / path escapes. Archive extraction can overwrite unrelated local files. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
Mechanism source for F-PODMAN-001-007
Security area (1seal assessment): Authorization. Malicious archive entries can modify attacker-chosen local files during extraction; the affected boundary is filesystem access. Reviewed 21 Sep 2026.