Skip to content
Fencer Vulns
high 8.1

CVE-2025-9566 json

Podman: podman kube play command may overwrite host files

published 2025-09-04 14 mo ago modified 2026-11-03 6 d ago also GHSA-wp3j-xq48-xpjw , GO-2025-3935 , EUVD-2025-27030

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.

Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1

Patch / fix

  • go github.com/containers/podman/v5 5.6.1
  • Red Hat Red Hat Enterprise Linux 10 6:5.4.0-13.el10_0, 7:5.6.0-5.el10_1, 7:5.8.0-2.el10
  • Red Hat Red Hat Enterprise Linux 8 8100020250911075811.afee755d
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020250919150821.3b538bd8
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020250919150821.3b538bd8
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020250919150821.3b538bd8
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020250919060528.0f77c1b7
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020250919060528.0f77c1b7
  • Red Hat Red Hat Enterprise Linux 9 5:5.4.0-13.el9_6, 6:5.6.0-6.el9_7, 6:5.8.0-1.el9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 2:4.2.0-6.el9_0.5
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2:4.4.1-22.el9_2.4
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 4:4.9.4-18.el9_4.3
  • Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202510291903-0
  • Red Hat Red Hat OpenShift Container Platform 4.13 413.92.202510150118-0
  • Red Hat Red Hat OpenShift Container Platform 4.14 0:5.14.0-284.138.1.el9_2, 0:5.14.0-284.138.1.rt14.423.el9_2, 3:4.4.1-23.rhaos4.14.el8, 414.92.202510211419-0
  • Red Hat Red Hat OpenShift Container Platform 4.15 0:5.14.0-284.138.1.el9_2, 0:5.14.0-284.138.1.rt14.423.el9_2, 3:4.4.1-35.rhaos4.15.el8, 415.92.202609140326-0
  • Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202609011112-0
  • Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202510112152-0
  • Red Hat Red Hat OpenShift Container Platform 4.18 0:1.31.12-3.rhaos4.18.gitdc59c78.el8, 0:4.18.0-202509011551.p2.g018e43a.assembly.stream.el8, 0:4.18.0-202509090932.p2.ga4cad44.assembly.stream.el8, 0:5.14.0-427.87.1.el9_4, 4:2.237.0-1.rhaos4.18.el9, 5:5.2.2-11.rhaos4.18.el9, 418.94.202510230424-0
  • Red Hat Red Hat OpenShift Container Platform 4.19 0:1.32.8-3.rhaos4.19.git60d4e21.el9, 0:4.19.0-202509070341.p2.gb5229e8.assembly.stream.el9, 4:2.237.0-1.rhaos4.19.el9, 4.19.9.6.202510140714-0, 5:5.4.0-7.rhaos4.19.el9
  • Red Hat Red Hat OpenShift Container Platform 4.20 4.20.9.6.202510220229-0, 5:5.4.0-12.rhaos4.20.el9
  • Red Hat Red Hat Hardened Images 5.8.2-1.hum1
  • Red Hat Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 3.24-1760921292, 3.24-1761160160
  • podman Debian 14 5.6.1+ds1-2

debian advisories DEBIAN-CVE-2025-9566

  • podman RHEL 9 6:5.8.0-1.el9
  • podman-tests RHEL 9 6:5.8.0-1.el9
  • podman-docker RHEL 9 6:5.8.0-1.el9
  • podman-remote RHEL 9 6:5.8.0-1.el9
  • podman-plugins RHEL 9 6:5.8.0-1.el9
  • podman RHEL 10.2 7:5.8.0-2.el10
  • podman-tests RHEL 10.2 7:5.8.0-2.el10
  • podman-docker RHEL 10.2 7:5.8.0-2.el10

red hat advisories RHSA-2026:18722RHSA-2026:18289RHSA-2026:8211RHBA-2025:16163RHEA-2025:4782RHBA-2025:15692

  • podman Linux Micro 6.1 5.4.2-slfo.1.1_6.1
  • podman Linux Micro 6.0 4.9.5-12.1
  • podman Linux Micro 6.1 5.4.2-slfo.1.1_5.1
  • podman SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 5.4.2-160000.4.1
  • podman SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 5.4.2-160000.3.1
  • podman SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Module for Containers 15 SP7 +7 more 4.9.5-150500.3.49.1
  • podman Linux Micro 6.1 5.4.2-slfo.1.1_2.1
  • podman Linux Micro 6.0 4.9.5-8.1

suse advisories SUSE-SU-2026:24378-1SUSE-SU-2026:22516-1SUSE-SU-2026:22451-1SUSE-SU-2026:20626-1SUSE-SU-2026:20641-1SUSE-SU-2026:20103-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • podman openSUSE Leap 16.0 5.4.2-160000.5.1
  • podman openSUSE Leap 16.0 5.4.2-160000.4.1
  • podman openSUSE Leap 16.0 5.4.2-160000.3.1
  • podman openSUSE Tumbleweed 5.7.1-1.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250908T141310-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:21244-1openSUSE-SU-2026:20305-1openSUSE-SU-2026:20072-1openSUSE-SU-2025:15845-1openSUSE-SU-2025:15538-1

  • podman AlmaLinux 9 6:5.6.0-6.el9_7
  • podman-tests AlmaLinux 9 6:5.6.0-6.el9_7
  • podman-docker AlmaLinux 9 6:5.6.0-6.el9_7
  • podman-remote AlmaLinux 9 6:5.6.0-6.el9_7
  • podman-plugins AlmaLinux 9 6:5.6.0-6.el9_7
  • podman AlmaLinux 10 7:5.6.0-5.el10_1
  • podman-tests AlmaLinux 10 7:5.6.0-5.el10_1
  • podman-docker AlmaLinux 10 7:5.6.0-5.el10_1

almalinux advisories ALSA-2025:20909ALSA-2025:20983ALSA-2025:15900ALSA-2025:15901ALSA-2025:15904

  • podman Rocky Linux 9 6:5.8.0-1.el9
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1872+2e18eb19
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1815+5fe7415e
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1896+b18fa106
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1880+8e896d1b
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1825+623b0c20
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+2001+6a33db9f
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1874+ce489889

rocky linux advisories RLSA-2026:18722RLSA-2025:15904RLSA-2025:15900RLSA-2025:15901

  • podman Alpine 3.24, Alpine 3.23, Alpine 3.22 5.6.1-r0

alpine advisories ALPINE-CVE-2025-9566

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-9566 updated cvss 8.1

podman: Podman kube play command may overwrite host files

  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+23498+f7d19d48, criu 3.18-5.module+el8.10.0+23498+f7d19d48, crun 1.14.3-2.module+el8.10.0+23498+f7d19d48, runc 1.1.12-6.module+el8.10.0+23498+f7d19d48, udica 0.2.6-21.module+el8.10.0+23498+f7d19d48, conmon 2.1.10-1.module+el8.10.0+23498+f7d19d48, +27 more
    fixed: vendor fix RHSA-2025:15904
  • Red Hat Enterprise Linux AppStream (v. 9) podman 5.8.0-1.el9, podman 5.6.0-6.el9_7, podman 5.4.0-13.el9_6, podman-tests 5.8.0-1.el9, podman-docker 5.8.0-1.el9, podman-remote 5.8.0-1.el9, +9 more
    fixed: vendor fix RHSA-2025:15900
  • Red Hat Enterprise Linux AppStream (v. 10) podman 5.8.0-2.el10, podman 5.6.0-5.el10_1, podman 5.4.0-13.el10_0, podman-docker 5.8.0-2.el10, podman-remote 5.8.0-2.el10, podman-docker 5.6.0-5.el10_1, +3 more
    fixed: vendor fix RHSA-2025:15901
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) crun 1.5-1.module+el8.6.0+22769+fa0fe772, crit 3.15-3.module+el8.6.0+22769+fa0fe772, criu 3.15-3.module+el8.6.0+22769+fa0fe772, runc 1.1.12-1.module+el8.6.0+22769+fa0fe772, udica 0.2.6-5.module+el8.6.0+22769+fa0fe772, conmon 2.1.4-1.module+el8.6.0+22769+fa0fe772, +27 more Red Hat Enterprise Linux AppStream E4S (v.8.6) crun 1.5-1.module+el8.6.0+22769+fa0fe772, crit 3.15-3.module+el8.6.0+22769+fa0fe772, criu 3.15-3.module+el8.6.0+22769+fa0fe772, runc 1.1.12-1.module+el8.6.0+22769+fa0fe772, udica 0.2.6-5.module+el8.6.0+22769+fa0fe772, conmon 2.1.4-1.module+el8.6.0+22769+fa0fe772, +27 more
    fixed: vendor fix RHSA-2025:16482
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) crit 3.15-4.module+el8.8.0+22334+bb93e398, criu 3.15-4.module+el8.8.0+22334+bb93e398, crun 1.8.4-2.module+el8.8.0+22334+bb93e398, runc 1.1.12-1.module+el8.8.0+22334+bb93e398, conmon 2.1.6-1.module+el8.8.0+22334+bb93e398, udica 0.2.6-20.module+el8.8.0+22334+bb93e398, +27 more
    fixed: vendor fix RHSA-2025:16515
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) podman 4.2.0-6.el9_0.5, podman-tests 4.2.0-6.el9_0.5, podman-docker 4.2.0-6.el9_0.5, podman-remote 4.2.0-6.el9_0.5, podman-gvproxy 4.2.0-6.el9_0.5, podman-plugins 4.2.0-6.el9_0.5, +1 more
    fixed: vendor fix RHSA-2025:16480
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) podman 4.4.1-22.el9_2.4, podman-tests 4.4.1-22.el9_2.4, podman-docker 4.4.1-22.el9_2.4, podman-remote 4.4.1-22.el9_2.4, podman-gvproxy 4.4.1-22.el9_2.4, podman-plugins 4.4.1-22.el9_2.4
    fixed: vendor fix RHSA-2025:16488
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) podman 4.9.4-18.el9_4.3, podman-tests 4.9.4-18.el9_4.3, podman-docker 4.9.4-18.el9_4.3, podman-remote 4.9.4-18.el9_4.3, podman-plugins 4.9.4-18.el9_4.3
    fixed: vendor fix RHSA-2025:16481
show 15 more
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) crun 1.5-1.module+el8.6.0+22769+fa0fe772, crit 3.15-3.module+el8.6.0+22769+fa0fe772, criu 3.15-3.module+el8.6.0+22769+fa0fe772, runc 1.1.12-1.module+el8.6.0+22769+fa0fe772, udica 0.2.6-5.module+el8.6.0+22769+fa0fe772, conmon 2.1.4-1.module+el8.6.0+22769+fa0fe772, +27 more
    fixed: vendor fix RHSA-2025:16482
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) crit 3.15-4.module+el8.8.0+22334+bb93e398, criu 3.15-4.module+el8.8.0+22334+bb93e398, crun 1.8.4-2.module+el8.8.0+22334+bb93e398, runc 1.1.12-1.module+el8.8.0+22334+bb93e398, conmon 2.1.6-1.module+el8.8.0+22334+bb93e398, udica 0.2.6-20.module+el8.8.0+22334+bb93e398, +27 more
    fixed: vendor fix RHSA-2025:16515
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests 5.8.0-2.el10, podman-tests 5.6.0-5.el10_1, podman-tests 5.4.0-13.el10_0
    fixed: vendor fix RHSA-2025:15901
  • Red Hat Hardened Images podman 5.8.2-1.hum1, podmansh 5.8.2-1.hum1, podman-tests 5.8.2-1.hum1, podman-docker 5.8.2-1.hum1, podman-remote 5.8.2-1.hum1, podman-machine 5.8.2-1.hum1
    fixed: vendor fix RHSA-2026:8211
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202510291903
    fixed: vendor fix RHSA-2025:19894
  • Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202510150118
    fixed: vendor fix RHSA-2025:18240
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202510211419, perf 5.14.0-284.138.1.el9_2, rtla 5.14.0-284.138.1.el9_2, bpftool 7.0.0-284.138.1.el9_2, kernel 5.14.0-284.138.1.el9_2, podman 4.4.1-23.rhaos4.14.el8, +80 more
    fixed: vendor fix RHBA-2025:16163
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202609140326, perf 5.14.0-284.138.1.el9_2, rtla 5.14.0-284.138.1.el9_2, bpftool 7.0.0-284.138.1.el9_2, kernel 5.14.0-284.138.1.el9_2, podman 4.4.1-35.rhaos4.15.el8, +80 more
    fixed: vendor fix RHBA-2025:16158
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202609011112
    fixed: vendor fix RHSA-2026:62549
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202510112152
    fixed: vendor fix RHSA-2025:18218
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202510230424, perf 5.14.0-427.87.1.el9_4, rtla 5.14.0-427.87.1.el9_4, bpftool 7.3.0-427.87.1.el9_4, kernel 5.14.0-427.87.1.el9_4, podman 5.2.2-11.rhaos4.18.el9, +89 more
    fixed: vendor fix RHBA-2025:15712
  • Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202510140714, podman 5.4.0-7.rhaos4.19.el9, podman-tests 5.4.0-7.rhaos4.19.el9, podman-docker 5.4.0-7.rhaos4.19.el9, podman-remote 5.4.0-7.rhaos4.19.el9, podman-plugins 5.4.0-7.rhaos4.19.el9, +8 more
    fixed: vendor fix RHBA-2025:15692
  • Red Hat OpenShift Container Platform 4.20 rhcos 4.20.9.6.202510220229, podman 5.4.0-12.rhaos4.20.el9, podman-tests 5.4.0-12.rhaos4.20.el9, podman-docker 5.4.0-12.rhaos4.20.el9, podman-remote 5.4.0-12.rhaos4.20.el9, podman-plugins 5.4.0-12.rhaos4.20.el9
    fixed: vendor fix RHEA-2025:4782
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 devspaces 3.24-1760921292, devspaces 3.24-1761160160
    fixed: vendor fix RHSA-2025:19094
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.20 tox 4.14.2-2.el9ocp, flit 3.9.0-3.1.el9ocp, future 0.18.3-8.el9ocp, pytz 2024.2-1.1.el9ocp, babel 2.12.1-6.1.el9ocp, poetry 1.3.2-3.1.el9ocp, +657 more Red Hat OpenShift Container Platform 4.20 cri-tools 1.33.0-1.el9, toolbox 0.1.2-1.rhaos4.20.el9, wasmedge 0.14.0-2.rhaos4.20.el9, wasmedge-rt 0.14.0-2.rhaos4.20.el9, kata-containers 3.17.0-4.rhaos4.20.el9, cri-o 1.33.4-4.rhaos4.20.gitc8e7df2.el9, +28 more Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 devspaces 3.24-1759870356, devspaces 3.24-1759871071, devspaces 3.24-1759871505, devspaces 3.24-1759871621, devspaces 3.24-1759871872, devspaces 3.24-1760653610, +8 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
14 mo ago

Exploit prediction

1.21% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/containers/podman/v5
<5.6.1
5.6.1
go github.com/containers/podman/v4
<=4.9.5
all versions
 no fix listed
go github.com/containers/podman
all versions
 no fix listed
go github.com/containers/podman/v2
all versions
 no fix listed
go github.com/containers/podman/v3
all versions
 no fix listed

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift Dev Spaces (RHOSDS) 3.24

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-61 UNIX Symbolic Link (Symlink) Following

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.