high7.1
CVE-2026-53489
Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
Impact
containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/containerd/containerd/v2 | >= 2.1.0, < 2.1.9 | 2.1.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linuxfoundation | Containerd | from 2.1.0 before 2.1.9 from 2.2.0 before 2.2.5 from 2.3.0 before 2.3.2 |