CVE-2025-9566

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.

Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1

References

Affected packages

Git / github.com/containers/podman

Affected ranges

Type: GIT
Repo: https://github.com/containers/podman
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

43fbde4e665fe6cee6921868f04b7ccd3de5ad89

Affected versions

v0.*

v0.10.1

v0.10.1.1

v0.10.1.2

v0.10.1.3

v0.11.1

v0.11.1.1

v0.12.1

v0.12.1.1

v0.12.1.2

v0.2

v0.2.1

v0.2.2

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.6.1

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.8.1

v0.8.2

v0.8.2.1

v0.8.3

v0.8.4

v0.8.5

v0.9.1

v0.9.1.1

v0.9.2

v0.9.2.1

v0.9.3

v0.9.3.1

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.1.0

v1.1.1

v1.1.2

v1.2.0

v1.3.0

v1.3.1

v1.3.2

v1.4.0

v1.4.1

v1.4.2

v1.4.2-stable1

v1.4.2-stable2

v1.4.2-stable3

v1.4.3

v1.4.4

v1.5.0

v1.5.1

v1.6.0

v1.6.0-rc1

v1.6.0-rc2

v1.6.1

v1.6.1-rc1

v1.6.2

v1.6.2-rc1

v1.6.3

v1.6.3-rc1

v1.6.4

v1.6.5

v1.7.0

v1.7.0-rc1

v1.7.0-rc2

v1.8.0

v1.8.0-rc1

v1.8.1

v1.8.1-rc1

v1.8.1-rc2

v1.8.1-rc3

v1.8.1-rc4

v1.8.2

v1.8.2-rc1

v1.9.0

v1.9.0-rc1

v1.9.0-rc2

v1.9.1

v1.9.2

v1.9.3

v2.*

v2.0.0

v2.0.0-rc1

v2.0.0-rc2

v2.0.0-rc3

v2.0.0-rc4

v2.0.0-rc5

v2.0.0-rc6

v2.0.0-rc7

v2.0.1

v2.0.2

v2.0.3

v2.0.4

v2.0.5

v2.0.6

v2.0.6-rc1

v2.1.0

v2.1.0-rc1

v2.1.0-rc2

v2.1.1

v2.2.0

v2.2.0-rc1

v2.2.0-rc2

v2.2.1

v3.*

v3.0.0

v3.0.0-rc1

v3.0.0-rc2

v3.0.0-rc3

v3.0.1

v3.0.2

v3.1.0

v3.1.0-rc1

v3.1.0-rc2

v3.1.1

v3.1.2

v3.2.0

v3.2.0-rc1

v3.2.0-rc2

v3.2.0-rc3

v3.2.1

v3.2.2

v3.2.3

v3.3.0

v3.3.0-rc1

v3.3.0-rc2

v3.3.0-rc3

v3.3.1

v3.4.0

v3.4.0-rc1

v3.4.0-rc2

v3.4.1

v3.4.2

v3.4.3

v3.4.4

v3.4.5

v3.4.6

v3.4.7

v4.*

v4.0.0

v4.0.0-rc1

v4.0.0-rc2

v4.0.0-rc3

v4.0.0-rc4

v4.0.0-rc5

v4.0.1

v4.0.2

v4.0.3

v4.1.0

v4.1.0-rc1

v4.1.0-rc2

v4.1.1

v4.2.0

v4.2.0-rc1

v4.2.0-rc2

v4.2.0-rc3

v4.2.1

v4.3.0

v4.3.0-rc1

v4.3.1

v4.4.0

v4.4.0-rc1

v4.4.0-rc2

v4.4.0-rc3

v4.4.1

v4.4.2

v4.4.3

v4.4.4

v4.5.0

v4.5.0-rc1

v4.5.0-rc2

v4.5.1

v4.6.0

v4.6.0-rc1

v4.6.0-rc2

v4.6.1

v4.6.2

v4.7.0

v4.7.0-rc1

v4.7.1

v4.7.2

v4.8.0

v4.8.0-rc1

v4.8.1

v4.8.2

v4.8.3

v4.9.0

v4.9.1

v4.9.2

v4.9.3

v4.9.4

v4.9.5

v5.*

v5.0.0

v5.0.0-rc1

v5.0.0-rc2

v5.0.0-rc3

v5.0.0-rc4

v5.0.0-rc5

v5.0.0-rc6

v5.0.0-rc7

v5.0.1

v5.0.2

v5.0.3

v5.1.0

v5.1.0-rc1

v5.1.1

v5.1.2

v5.2.0

v5.2.0-rc1

v5.2.0-rc2

v5.2.0-rc3

v5.2.1

v5.2.2

v5.2.3

v5.2.4

v5.2.5

v5.3.0

v5.3.0-rc1

v5.3.0-rc2

v5.3.0-rc3

v5.3.1

v5.3.2

v5.4.0

v5.4.0-rc1

v5.4.0-rc2

v5.4.0-rc3

v5.4.1

v5.4.2

v5.5.0

v5.5.0-rc1

v5.5.0-rc2

v5.5.1

v5.5.2

v5.6.0

v5.6.0-rc1

v5.6.0-rc2

v5.6.1

v5.6.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9566.json"