CVE-2026-79705

Name	CVE-2026-79705
Description	A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-containers-buildah (PTS)	bookworm	1.28.2+ds1-3+deb12u1	vulnerable
	trixie	1.39.3+ds1-1	vulnerable
	forky, sid	1.43.2+ds1-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-containers-buildah	source	(unstable)	(unfixed)

Notes

[trixie] - golang-github-containers-buildah <no-dsa> (Minor issue)
[bookworm] - golang-github-containers-buildah <postponed> (Limited support, minor issue, uncommon use case)
https://bugzilla.redhat.com/show_bug.cgi?id=2523419