CVE-2025-9566 Podman: podman kube play command may overwrite host files
An attacker can overwrite arbitrary host files via symbolic links in ConfigMap or Secret volumes when using the podman kube play command.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9566?
CVE-2025-9566 is a high-severity path traversal vulnerability in Red Hat Enterprise Linux 10, published on 5 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.
Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1
Weakness: CWE-22
Which versions are affected by CVE-2025-9566?
9 open source packages ship an affected version, including github.com/containers/podman/v4, github.com/containers/podman and github.com/containers/podman/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/podman/v4 Go | All versions | None |
github.com/containers/podman/v4 Go | All versions to 4.9.5 | None |
github.com/containers/podman/v4 Go | All versions to 4.9.5 | None |
github.com/containers/podman Go | All versions | None |
github.com/containers/podman/v2 Go | All versions | None |
github.com/containers/podman/v3 Go | All versions | None |
3 more packages
github.com/containers/podman/v5 Go | All versions | 5.6.1 |
github.com/containers/podman/v5 Go | All versions | 5.6.1 |
github.com/containers/podman/v5 Go | All versions | 5.6.1 |
Linux distribution packages (31)
podman-docker AlmaLinux:10 | All versions | 6:5.4.0-13.el10_0 |
aardvark-dns AlmaLinux:8 | All versions | 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 |
aardvark-dns AlmaLinux:8 | All versions | 2:1.10.1-2.module_el8.10.0+4023+db236c53 |
aardvark-dns AlmaLinux:8 | All versions | 2:1.10.1-2.module_el8.10.0+4047+545787c4 |
buildah AlmaLinux:8 | All versions | 2:1.33.12-2.module_el8.10.0+4016+efd18bf8 |
buildah AlmaLinux:8 | All versions | 2:1.33.12-2.module_el8.10.0+4023+db236c53 |
buildah AlmaLinux:8 | All versions | 2:1.33.12-2.module_el8.10.0+4047+545787c4 |
buildah-tests AlmaLinux:8 | All versions | 2:1.33.12-2.module_el8.10.0+4047+545787c4 |
cockpit-podman AlmaLinux:8 | All versions | 84.1-1.module_el8.10.0+4016+efd18bf8 |
conmon AlmaLinux:8 | All versions | 3:2.1.10-1.module_el8.10.0+3970+8445edf6 |
container-selinux AlmaLinux:8 | All versions | 2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7 |
containernetworking-plugins AlmaLinux:8 | All versions | 1:1.4.0-6.module_el8.10.0+4016+efd18bf8 |
containernetworking-plugins AlmaLinux:8 | All versions | 1:1.4.0-6.module_el8.10.0+4023+db236c53 |
containernetworking-plugins AlmaLinux:8 | All versions | 1:1.4.0-6.module_el8.10.0+4047+545787c4 |
containers-common AlmaLinux:8 | All versions | 2:1-82.module_el8.10.0+3876+e55593a8 |
containers-common AlmaLinux:8 | All versions | 2:1-82.module_el8.10.0+3901+4b80ecd7 |
containers-common AlmaLinux:8 | All versions | 2:1-82.module_el8.10.0+3970+8445edf6 |
containers-common AlmaLinux:8 | All versions | 2:1-82.module_el8.10.0+4047+545787c4 |
crit AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3845+87b84552 |
crit AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3858+6ad51f9f |
crit AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3901+4b80ecd7 |
crit AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+4047+545787c4 |
criu AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3876+e55593a8 |
criu AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3909+6e1c1eb7 |
criu AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3926+f12484f5 |
criu AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3970+8445edf6 |
criu-devel AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3858+6ad51f9f |
criu-devel AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3876+e55593a8 |
criu-devel AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+4016+efd18bf8 |
criu-devel AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+4023+db236c53 |
criu-libs AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3909+6e1c1eb7 |
How do I fix CVE-2025-9566?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-9566 being exploited?
There is no known exploitation of CVE-2025-9566 in the wild and no public exploit code.
Sources
Also known as ALSA-2025:15900, ALSA-2025:15901, ALSA-2025:15904, AZL-67046, AZL-67049, BELL-CVE-2025-9566 and 27 more.