Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Podman before 1.4.0 allows attackers to access host files through containers

CVE-2019-10152 · published 7 years ago
Summary

An attacker who has compromised a container can read or write any file on the host computer. This is a serious risk because it allows the attacker to access sensitive information or make changes to the system. Update to version 1.4.0 or later to fix this issue.

What to do
  • Update github.com containers to version 1.4.0.
  • Update libpod_project libpod to version 1.4.0 or later.
Affected software
Ecosystem VendorProductAffected versions
go github.com containers < 1.4.0
Fix: upgrade to 1.4.0
– libpod_project libpod < 1.4.0
cpe:2.3:a:libpod_project:libpod:*:*:*:*:*:*:*:*
– opensuse leap 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Original advisory text
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause a...
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-59Link Following
Timeline
Published30 Jul 2019
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-rh5f-2w6r-q7vj · GHSA
CVE-2019-10152 · NVD
Track software like this
Free during beta