Podman: arbitrary file write when importing oci archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

Problem type

Insecure Inherited Permissions

Affected products

Red Hat

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

Red Hat Hardened Images

Red Hat OpenShift Container Platform 4

Red Hat OpenShift Dev Spaces

References

access.redhat.com

https://access.redhat.com/security/cve/CVE-2025-11395

vdb-entryx_refsource_REDHAT

RHBZ#2402034

https://bugzilla.redhat.com/show_bug.cgi?id=2402034

issue-trackingx_refsource_REDHAT

GitHub Security Advisories

GHSA-6jv9-mhj9-v2h4

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load`...

https://github.com/advisories/GHSA-6jv9-mhj9-v2h4

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2025-11395

access.redhat.com

https://access.redhat.com/security/cve/CVE-2025-11395

bugzilla.redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2402034

github.com

https://github.com/advisories/GHSA-6jv9-mhj9-v2h4

JSON source

https://cveawg.mitre.org/api/cve/CVE-2025-11395

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2025-11395",
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "dateUpdated": "2026-09-15T22:59:03.366Z",
    "dateReserved": "2025-10-07T03:14:35.482Z",
    "datePublished": "2026-09-15T22:59:03.366Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat",
        "dateUpdated": "2026-09-15T22:59:03.366Z"
      },
      "datePublic": "2025-11-07T00:00:00.000Z",
      "title": "Podman: arbitrary file write when importing oci archive",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman."
        }
      ],
      "affected": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "buildah",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "podman",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "skopeo",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "buildah",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "container-tools:rhel8/podman",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "skopeo",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "buildah",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "podman",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "skopeo",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Hardened Images",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "podman",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "buildah",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "podman",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "rhcos",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "skopeo",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Dev Spaces",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "devspaces/udi-base-rhel9",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Dev Spaces",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "devspaces/udi-rhel9",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "affected"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Insecure Inherited Permissions",
              "cweId": "CWE-277",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://access.redhat.com/security/cve/CVE-2025-11395",
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ]
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402034",
          "name": "RHBZ#2402034",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ]
        }
      ],
      "metrics": [
        {},
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "attackVector": "ADJACENT_NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM"
          }
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "timeline": [
        {
          "time": "2025-10-07T03:10:59.473Z",
          "lang": "en",
          "value": "Reported to Red Hat."
        },
        {
          "time": "2025-11-07T00:00:00.000Z",
          "lang": "en",
          "value": "Made public."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank XeR for reporting this issue."
        }
      ]
    }
  }
}