medium4.5
CVE-2026-79705
A flaw was found in the buildah/copier Go package.
Impact
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Red Hat | Red Hat Hardened Images | Version patch: 6.1.3-1.hum1 |