There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.
Binary-Affected: podman
Upstream-version-introduced: v4.0.0
Upstream-version-fixed: v5.6.1
References
Configurations
No configuration.
History
No history.
Information
Published : 2025-09-05 20:15
Updated : 2026-03-19 18:16
NVD link : CVE-2025-9566
Mitre link : CVE-2025-9566
CVE.ORG link : CVE-2025-9566
JSON object : View
Products Affected
No product.
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')