{"id":"CVE-2025-4953","title":"A flaw was found in Podman","summary":"A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build c…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-378"],"published":"2025-09-16","updated":"2026-06-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-4953","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:8690","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:15904","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:16724","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:16729","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:17669","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:22265","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:22275","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:22695","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:22724","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:22732","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:23113","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:2703","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:0316","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2025-4953","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2367235","label":"secalert@redhat.com"},{"url":"https://github.com/containers/podman/pull/25173","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-4953.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4953"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4953"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00639,"epssPercentile":0.49202,"ingestedAt":"2026-06-29T13:24:34.560Z","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","affected":["openshift_container_platform 4","openshift_container_platform 4.12","openshift_container_platform 4.13","openshift_container_platform 4.16","openshift_container_platform 4.18","openshift_container_platform 4.14","openshift_container_platform 4.15","openshift_container_platform 4.17","enterprise_linux_appstream_v_8"],"patched":["openshift_container_platform 4.12","openshift_container_platform 4.13","openshift_container_platform 4.16","openshift_container_platform 4.18","openshift_container_platform 4.14","openshift_container_platform 4.15","openshift_container_platform 4.17","enterprise_linux_appstream_v_8"],"slug":"CVE-2025-4953","body":"## Overview\n\nA flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2025:17669** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2025-10-16 · [advisory](https://access.redhat.com/errata/RHSA-2025:17669)\n- **RHSA-2026:0316** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-01-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:0316)\n- **RHSA-2025:2703** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2025-03-20 · [advisory](https://access.redhat.com/errata/RHSA-2025:2703)\n- **RHSA-2024:8690** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2024-11-06 · [advisory](https://access.redhat.com/errata/RHSA-2024:8690)\n- **RHSA-2025:16724** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2025-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2025:16724)\n- **RHSA-2025:16729** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2025-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2025:16729)\n- **RHSA-2025:22275** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2025-12-05 · [advisory](https://access.redhat.com/errata/RHSA-2025:22275)\n- **RHSA-2025:22732** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:22732)\n- **RHSA-2025:23113** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-01-07 · [advisory](https://access.redhat.com/errata/RHSA-2025:23113)\n- **RHSA-2025:22724** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:22724)\n- **RHSA-2025:22265** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2025-12-03 · [advisory](https://access.redhat.com/errata/RHSA-2025:22265)\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-4953.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}