CVE-2025-4953 Podman: build context bind mount
Attackers can access files created during container builds on the host system due to improper cleanup of bind mounts in Podman.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-4953?
CVE-2025-4953 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 16 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.
Weakness: CWE-378
Which versions are affected by CVE-2025-4953?
7 open source packages ship an affected version, including github.com/containers/podman/v5, github.com/containers/podman and github.com/containers/podman/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/podman/v5 Go | All versions | None |
github.com/containers/podman/v5 Go | All versions to 5.5.0 | None |
github.com/containers/podman/v5 Go | All versions to 5.5.0 | None |
github.com/containers/podman Go | All versions | None |
github.com/containers/podman/v2 Go | All versions | None |
github.com/containers/podman/v3 Go | All versions | None |
1 more packages
github.com/containers/podman/v4 Go | All versions | None |
Linux distribution packages (13)
podman Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-catatonit Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-catatonit-debuginfo Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-debuginfo Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-debugsource Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-docker Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-gvproxy Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-gvproxy-debuginfo Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-plugins Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-plugins-debuginfo Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-remote Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-remote-debuginfo Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
podman-tests Red Hat:openshift:4.18::el8 | All versions | 5:5.2.2-2.rhaos4.18.el8 |
How do I fix CVE-2025-4953?
Apply the vendor's patch.
Is CVE-2025-4953 being exploited?
There is no known exploitation of CVE-2025-4953 in the wild and no public exploit code.
Sources
Also known as AZL-68054, DEBIAN-CVE-2025-4953, GHSA-m68q-4hqr-mc6f, GO-2025-3961, MINI-7hpp-94r3-fg22, MINI-94qv-459g-q337 and 3 more.