Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by redhat

CVE-2025-11395Podman: arbitrary file write when importing oci archive

Medium 5.5

In plain English

A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 60.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10buildah2:1.43.1-7.el10_2ALSA-2026:88262
AlmaLinux:9buildah2:1.43.4-2.el9_8ALSA-2026:90424
AlmaLinux:9buildah2:1.43.3-2.el9_8ALSA-2026:70640
AlmaLinux:10buildah-tests2:1.43.1-7.el10_2ALSA-2026:88262
AlmaLinux:9buildah-tests2:1.43.3-2.el9_8ALSA-2026:70640
AlmaLinux:9buildah-tests2:1.43.4-2.el9_8ALSA-2026:90424
AlmaLinux:10podman7:5.8.2-12.el10_2.alma.1ALSA-2026:93464
AlmaLinux:9podman6:5.8.2-8.el9_8ALSA-2026:90362
AlmaLinux:10podman-docker7:5.8.2-12.el10_2.alma.1ALSA-2026:93464
AlmaLinux:9podman-docker6:5.8.2-8.el9_8ALSA-2026:90362
AlmaLinux:9podman-plugins6:5.8.2-8.el9_8ALSA-2026:90362
AlmaLinux:10podman-remote7:5.8.2-12.el10_2.alma.1ALSA-2026:93464
AlmaLinux:9podman-remote6:5.8.2-8.el9_8ALSA-2026:90362
AlmaLinux:10podman-tests7:5.8.2-12.el10_2.alma.1ALSA-2026:93464
AlmaLinux:9podman-tests6:5.8.2-8.el9_8ALSA-2026:90362
AlmaLinux:10skopeo2:1.22.2-6.el10_2ALSA-2026:89761
AlmaLinux:9skopeo2:1.22.2-9.el9_8ALSA-2026:90462
AlmaLinux:9skopeo2:1.22.2-8.el9_8ALSA-2026:70641
AlmaLinux:10skopeo-tests2:1.22.2-6.el10_2ALSA-2026:89761
AlmaLinux:9skopeo-tests2:1.22.2-9.el9_8ALSA-2026:90462
AlmaLinux:9skopeo-tests2:1.22.2-8.el9_8ALSA-2026:70641
Alpine:v3.24podman5.8.8-r0ALPINE-CVE-2025-11395
Debian:13podmanno fix listedDEBIAN-CVE-2025-11395
Debian:14podmanno fix listedDEBIAN-CVE-2025-11395
Rocky Linux:10buildah2:1.43.1-7.el10_2RLSA-2026:88262
Rocky Linux:9buildah2:1.43.4-2.el9_8RLSA-2026:90424
Rocky Linux:9buildah2:1.43.3-2.el9_8RLSA-2026:70640
Rocky Linux:10podman7:5.8.2-12.el10_2RLSA-2026:93464
Rocky Linux:9podman6:5.8.2-8.el9_8RLSA-2026:90362
Rocky Linux:10skopeo2:1.22.2-6.el10_2RLSA-2026:89761
Rocky Linux:9skopeo2:1.22.2-9.el9_8RLSA-2026:90462
Rocky Linux:9skopeo2:1.22.2-8.el9_8RLSA-2026:70641
Ubuntu:26.04:LTSpodmanno fix listedUBUNTU-CVE-2025-11395
Ubuntu:26.10podmanno fix listedUBUNTU-CVE-2025-11395

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Dev Spaces see references
Red Hat Red Hat OpenShift Dev Spaces see references

Weakness: CWE-277 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References