VDB

CVE-2025-11395

CVE-2025-11395 PUBLISHED CVSS 5.5 MEDIUM

Podman: arbitrary file write when importing oci archive

Reported by redhat · Published September 15, 2026

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
podman-plugins-debuginfoerrata.rockylinux.org6:5.8.2-8.el9_8.x86_64, 6:5.8.2-8.el9_8.s390x, 6:5.8.2-8.el9_8.ppc64le, 6:5.8.2-8.el9_8.aarch64
buildah-debuginfoerrata.rockylinux.org2:1.43.4-2.el9_8.x86_64, 2:1.43.4-2.el9_8.s390x, 2:1.43.4-2.el9_8.aarch64, 2:1.43.1-7.el10_2.x86_64, 2:1.43.1-7.el10_2.aarch64, 1.43.3-2.el9, 1.43.1-7.el10
skopeo-debuginfoerrata.rockylinux.org2:1.22.2-9.el9_8.x86_64, 2:1.22.2-9.el9_8.s390x, 2:1.22.2-9.el9_8.ppc64le, 2:1.22.2-9.el9_8.aarch64, 2:1.22.2-6.el10_2.s390x, 2:1.22.2-6.el10_2.aarch64, 1.22.2-8.el9, 1.22.2-6.el10
podman-debugsourceerrata.rockylinux.org7:5.8.2-12.el10_2.s390x, 7:5.8.2-12.el10_2.ppc64le, 6:5.8.2-8.el9_8.aarch64
podman-debuginfoerrata.rockylinux.org7:5.8.2-12.el10_2.ppc64le, 7:5.8.2-12.el10_2.aarch64, 6:5.8.2-8.el9_8.s390x, 6:5.8.2-8.el9_8.ppc64le, 6:5.8.2-8.el9_8.aarch64
buildah-tests-debuginfoerrata.rockylinux.org2:1.43.4-2.el9_8.x86_64, 2:1.43.4-2.el9_8.s390x, 2:1.43.4-2.el9_8.aarch64, 2:1.43.1-7.el10_2.aarch64, 1.43.3-2.el9, 1.43.1-7.el10
podman-remote-debuginfoerrata.rockylinux.org7:5.8.2-12.el10_2.x86_64, 7:5.8.2-12.el10_2.s390x, 7:5.8.2-12.el10_2.aarch64, 6:5.8.2-8.el9_8.x86_64
podman-remoteerrata.rockylinux.org7:5.8.2-12.el10_2.x86_64, 7:5.8.2-12.el10_2.s390x, 7:5.8.2-12.el10_2.ppc64le, 7:5.8.2-12.el10_2.aarch64, 6:5.8.2-8.el9_8.x86_64, 6:5.8.2-8.el9_8.s390x, 6:5.8.2-8.el9_8.ppc64le
podman-tests-debuginfoerrata.rockylinux.org7:5.8.2-12.el10_2.x86_64, 7:5.8.2-12.el10_2.s390x, 7:5.8.2-12.el10_2.ppc64le, 7:5.8.2-12.el10_2.aarch64, 6:5.8.2-8.el9_8.x86_64, 6:5.8.2-8.el9_8.s390x, 6:5.8.2-8.el9_8.ppc64le
skopeoerrata.rockylinux.org2:1.22.2-9.el9_8.x86_64, 2:1.22.2-9.el9_8.src, 2:1.22.2-9.el9_8.s390x, 2:1.22.2-9.el9_8.ppc64le, 2:1.22.2-9.el9_8.aarch64, 2:1.22.2-6.el10_2.x86_64, 2:1.22.2-6.el10_2.src, 2:1.22.2-6.el10_2.s390x, 2:1.22.2-6.el10_2.aarch64, 1.22.2-8.el9, 1.22.2-6.el10
podmanerrata.rockylinux.org7:5.8.2-12.el10_2.src, 7:5.8.2-12.el10_2.s390x, 7:5.8.2-12.el10_2.ppc64le, 7:5.8.2-12.el10_2.aarch64, 6:5.8.2-8.el9_8.x86_64, 6:5.8.2-8.el9_8.src, 6:5.8.2-8.el9_8.s390x, 6:5.8.2-8.el9_8.aarch64
podman-testserrata.rockylinux.org7:5.8.2-12.el10_2.x86_64, 7:5.8.2-12.el10_2.ppc64le, 6:5.8.2-8.el9_8.s390x

9 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
5.5
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

VendorProductVersions
Red HatRed Hat Enterprise Linux 102:1.43.1-7.el10_2
Red HatRed Hat Enterprise Linux 102:1.22.2-6.el10_2
Red HatRed Hat Enterprise Linux 107:5.8.2-12.el10_2
Red HatRed Hat Enterprise Linux 92:1.43.3-2.el9_8
Red HatRed Hat Enterprise Linux 92:1.22.2-8.el9_8
Red HatRed Hat Enterprise Linux 96:5.8.2-8.el9_8
Red HatRed Hat Enterprise Linux 92:1.43.4-2.el9_8
Red HatRed Hat Enterprise Linux 92:1.22.2-9.el9_8
Red HatRed Hat Enterprise Linux 8
Red HatRed Hat Enterprise Linux 8
Red HatRed Hat Enterprise Linux 8
Red HatRed Hat Hardened Images
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Dev Spaces
Red HatRed Hat OpenShift Dev Spaces
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Dev Spaces

…and 16 more

Timeline

  • Sep 15, 2026 CVE Published
  • Sep 16, 2026 EPSS Score (20 in total, the first dated here)
  • Sep 16, 2026 Coalition ESS Score
  • Sep 24, 2026 Distribution Patch (16 in total, the first dated here)
  • Sep 24, 2026 Security Advisory (9 in total, the first dated here)
  • Nov 4, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-11395
vulnetix vdb fixes CVE-2025-11395

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-11395/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›