Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Important: buildah Security Update for Directory Traversal

published 3 months ago

Summary

A security update is available for buildah, a tool used to build container images. This update fixes a vulnerability that could allow attackers to access parts of the system they shouldn't be able to access. It's recommended to update your buildah package to the latest version to ensure your system's security.

What to do

Update rocky buildah to version 2:1.43.1-4.el10_2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:10	rocky	buildah	< 2:1.43.1-4.el10_2 Fix: upgrade to 2:1.43.1-4.el10_2

Original advisory text

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:38494 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2498152 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Timeline

Published14 Jul 2026

Updated14 Jul 2026

First seen14 Jul 2026

Sources

RLSA-2026:38494 · OSV

Track software like this

Free during beta