Vulnerability record/PUBLISHED/Published Sep 15, 2026 16:23:26 UTC
CVE-2026-79705
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Base score4.5/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredHighPR
User interactionRequiredUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactHighI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedOct 30, 2026 07:26:01 UTC
PublishedSep 15, 2026 16:23:26 UTC
ReservedAug 25, 2026 12:47:21 UTC
Credits
- Red Hat would like to thank Ibrahim Saglam, Junyi Liu, Oleh Konko, and Ron Masas for reporting this issue.