CVE-2026-79705

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

Score

CVSS 3.1 4.5 Medium

Status

Awaiting Analysis - secalert@redhat.com

Published

2026-09-15

Last modified

2026-10-02

Weaknesses

CWE-22

Affected products

• Ansible Automation Platform (Redhat)
• Container Native Virtualization (Redhat)
• Enterprise Linux (Redhat)
• Hummingbird (Redhat)
• Openshift (Redhat)
• Openshift Devspaces (Redhat)
• Quay (Redhat)

References

• https://access.redhat.com/errata/RHSA-2026:74861
• https://access.redhat.com/security/cve/CVE-2026-79705
• https://bugzilla.redhat.com/show_bug.cgi?id=2523419