CVE-2025-9566

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-9566
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9566.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-9566
Aliases
Downstream
AZL (2)
BELL (1)
CGA (4)
CLSA (1)
DEBIAN (1)
MINI (1)
openSUSE (6)
RHBA (4)
RHEA (1)
RHSA (15)
RLSA (4)
SUSE (12)
UBUNTU (1)
Related
ALSA (5)
openSUSE (6)
SUSE (12)
Published
2025-09-05T19:54:30Z
Modified
2026-09-12T03:31:04Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
Podman: podman kube play command may overwrite host files
Details

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.

Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9566.json"
}
References

Affected packages

Git / github.com/podman-container-tools/podman

Affected ranges

Type
GIT
Repo
https://github.com/podman-container-tools/podman
Events
Introduced
84c8870ac236578c41713113fc09a29a5f727bdd
Fixed
43fbde4e665fe6cee6921868f04b7ccd3de5ad89
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "5.6.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9566.json"