---
id: CVE-2026-79705
title: A flaw was found in the buildah/copier Go package
summary: >-
  A flaw was found in the buildah/copier Go package. When used outside of
  Buildah by a non-root caller, a crafted tar archive containing malicious
  symlinks can escape the target extraction directory and create files outside
  the intended de…
severity: medium
cvss: 4.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-22
vendor: Red Hat
product: ansible-automation-platform-24/eda-controller-rhel8
affected:
  - ansible-automation-platform-24/eda-controller-rhel8 (all versions)
  - ansible-automation-platform-25/eda-controller-rhel8 (all versions)
  - ansible-automation-platform-26/eda-controller-rhel9 (all versions)
  - ansible-automation-platform-27/eda-controller-rhel9 (all versions)
  - python3.11-podman (all versions)
  - python3.12-podman (all versions)
  - python3x-podman (all versions)
  - python-podman (all versions)
  - buildah (all versions)
  - podman (all versions)
  - python-podman (all versions)
  - rhel10/buildah (all versions)
  - ubi10/buildah (all versions)
  - ubi10/podman (all versions)
  - 'container-tools:rhel8/buildah (all versions)'
  - 'container-tools:rhel8/podman (all versions)'
  - ubi8/buildah (all versions)
  - ubi8/podman (all versions)
  - buildah (all versions)
  - podman (all versions)
  - python-podman (all versions)
  - ubi9/buildah (all versions)
  - ubi9/podman (all versions)
  - buildah (all versions)
  - podman (all versions)
  - openshift/ose-rhel-coreos-8 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
  - podman (all versions)
  - devspaces/udi-base-rhel10 (all versions)
  - devspaces/udi-base-rhel9 (all versions)
  - devspaces/udi-rhel9 (all versions)
  - >-
    container-native-virtualization/ocp-virt-validation-checkup-rhel9 (all
    versions)
  - quay/quay-builder-rhel8 (all versions)
  - quay/quay-builder-rhel9 (all versions)
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:42:43.623'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79705'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-79705'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2523419'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79705.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-79705'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79705'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T17:28:09.238424Z'
ingestedAt: '2026-09-15T16:40:03.396Z'
epss: 0.00246
epssPercentile: 0.16178
---

## Overview

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79705.json)