Buildah (as part of Podman) vulnerable to Link Following

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-4122 · ADVISORY
• containers/podman#16315 · WEB
• containers/podman commit c8eeab2 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• GitHub Advisory GHSA-4crw-w8pw-2hmf · ADVISORY

More vulnerabilities in github.com/containers/podman

• CVE-2026-94603CRITICAL 10.0Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.a…
• CVE-2026-19730MEDIUM 4.2The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initia…
• CVE-2026-57231HIGH 7.5Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with j…
• CVE-2026-55686MEDIUM 5.3Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path co…
• CVE-2026-33414HIGH 7.8Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV …