A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Credits
Red Hat would like to thank Ibrahim Saglam, Junyi Liu, Oleh Konko, and Ron Masas for reporting this issue.
