CVE-2026-79705

NameCVE-2026-79705
DescriptionA flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
golang-github-containers-buildah (PTS)bookworm1.28.2+ds1-3+deb12u1vulnerable
trixie1.39.3+ds1-1vulnerable
forky, sid1.43.2+ds1-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
golang-github-containers-buildahsource(unstable)(unfixed)

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2523419

Search for package or bug name: Reporting problems