Vulnerability record/PUBLISHED/Published Sep 15, 2026 22:59:03 UTC
CVE-2025-11395
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
Base score5.5/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorAdjacentAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactLowA
CVSS vector string
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 11, 2026 22:54:47 UTC
PublishedSep 15, 2026 22:59:03 UTC
ReservedOct 7, 2025 03:14:35 UTC
Credits
- Red Hat would like to thank XeR for reporting this issue.