medium5.5
CVE-2025-11395
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load`...
Impact
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | All versions Versions patch: 2:1.43.1-7.el10_2, patch: 2:1.22.2-6.el10_2, patch: 7:5.8.2-12.el10_2 |
| Red Hat | Red Hat Enterprise Linux 9 | All versions Versions patch: 2:1.43.4-2.el9_8, patch: 2:1.43.3-2.el9_8, patch: 2:1.22.2-9.el9_8, patch: 6:5.8.2-8.el9_8, patch: 2:1.22.2-8.el9_8 |
| Red Hat | Red Hat Enterprise Linux 8 | All versions |
| Red Hat | Red Hat Hardened Images | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2026:70640
- https://access.redhat.com/errata/RHSA-2026:70641
- https://access.redhat.com/errata/RHSA-2026:88262
- https://access.redhat.com/errata/RHSA-2026:89761
- https://access.redhat.com/errata/RHSA-2026:90362
- https://access.redhat.com/errata/RHSA-2026:90424
- https://access.redhat.com/errata/RHSA-2026:90462
- https://access.redhat.com/security/cve/CVE-2025-11395
- https://bugzilla.redhat.com/show_bug.cgi?id=2402034
- https://access.redhat.com/errata/RHSA-2026:93464
- https://github.com/advisories/GHSA-6jv9-mhj9-v2h4
- https://nvd.nist.gov/vuln/detail/CVE-2025-11395