CVE-2025-9566

Name	CVE-2025-9566
Description	There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1114526

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libpod (PTS)	bullseye	3.0.1+dfsg1-3+deb11u5	vulnerable
	bookworm	4.3.1+ds1-8+deb12u1	vulnerable
podman (PTS)	trixie	5.4.2+ds1-2	vulnerable
	forky, sid	5.6.2+ds1-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
libpod	source	(unstable)	(unfixed)
podman	source	experimental	5.6.1+ds1-1
podman	source	(unstable)	5.6.1+ds1-2	1114526

Notes

[trixie] - podman <no-dsa> (Minor issue)
[bookworm] - libpod <no-dsa> (Minor issue)
[bullseye] - libpod <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2393152
Fixed by: https://github.com/containers/podman/commit/aaf8b9dc0cfec76444f7eda60660347646b90a13 (v5.6.1)