{"id":"CVE-2026-79705","title":"A flaw was found in the buildah/copier Go package","summary":"A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended de…","severity":"medium","cvss":4.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","cwe":["CWE-22"],"vendor":"Red Hat","product":"ansible-automation-platform-24/eda-controller-rhel8","affected":["ansible-automation-platform-24/eda-controller-rhel8 (all versions)","ansible-automation-platform-25/eda-controller-rhel8 (all versions)","ansible-automation-platform-26/eda-controller-rhel9 (all versions)","ansible-automation-platform-27/eda-controller-rhel9 (all versions)","python3.11-podman (all versions)","python3.12-podman (all versions)","python3x-podman (all versions)","python-podman (all versions)","buildah (all versions)","podman (all versions)","python-podman (all versions)","rhel10/buildah (all versions)","ubi10/buildah (all versions)","ubi10/podman (all versions)","container-tools:rhel8/buildah (all versions)","container-tools:rhel8/podman (all versions)","ubi8/buildah (all versions)","ubi8/podman (all versions)","buildah (all versions)","podman (all versions)","python-podman (all versions)","ubi9/buildah (all versions)","ubi9/podman (all versions)","buildah (all versions)","podman (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","podman (all versions)","devspaces/udi-base-rhel10 (all versions)","devspaces/udi-base-rhel9 (all versions)","devspaces/udi-rhel9 (all versions)","container-native-virtualization/ocp-virt-validation-checkup-rhel9 (all versions)","quay/quay-builder-rhel8 (all versions)","quay/quay-builder-rhel9 (all versions)"],"published":"2026-09-15","updated":"2026-09-16","sourceUpdated":"2026-09-16T19:42:43.623","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79705","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-79705","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523419","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79705.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79705"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79705"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-15T17:28:09.238424Z"},"ingestedAt":"2026-09-15T16:40:03.396Z","epss":0.00246,"epssPercentile":0.16156,"slug":"CVE-2026-79705","body":"## Overview\n\nA flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79705.json)","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":24.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}