Vulnerability · Published Sep 16, 2025 · Assigned by redhat

CVE-2025-4953Podman: build context bind mount

High 7.4

In plain English

A high-severity security flaw in podman. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.6%top 49.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libpod	no fix listed	DEBIAN-CVE-2025-4953
Debian:13	podman	5.3.2+ds1-1	DEBIAN-CVE-2025-4953
Debian:14	podman	5.3.2+ds1-1	DEBIAN-CVE-2025-4953
Go	github.com/containers/podman	no fix listed	GO-2025-3961
Go	github.com/containers/podman/v2	no fix listed	GO-2025-3961
Go	github.com/containers/podman/v3	no fix listed	GO-2025-3961
Go	github.com/containers/podman/v4	no fix listed	GO-2025-3961
Go	github.com/containers/podman/v5	no fix listed	GHSA-m68q-4hqr-mc6f
Go	github.com/containers/podman/v5	no fix listed	GO-2025-3961
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	buildah	2:1.33.12-2.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+1825+623b0c20	RLSA-2025:15904
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	conmon	3:2.1.10-1.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	conmon	3:2.1.10-1.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	conmon	3:2.1.10-1.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	conmon	3:2.1.10-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Rocky Linux:8	conmon	3:2.1.10-1.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	conmon	3:2.1.10-1.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	conmon	3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	conmon	3:2.1.10-1.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+1825+623b0c20	RLSA-2025:15904
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	containernetworking-plugins	1:1.4.0-6.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	containers-common	2:1-82.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	containers-common	2:1-82.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	containers-common	2:1-82.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	containers-common	2:1-82.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	containers-common	2:1-82.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	containers-common	2:1-82.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	containers-common	2:1-82.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+1825+623b0c20	RLSA-2025:15904
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+1825+623b0c20	RLSA-2025:15904
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1825+623b0c20	RLSA-2025:15904
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+1825+623b0c20	RLSA-2025:15904
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+1825+623b0c20	RLSA-2025:15904
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1825+623b0c20	RLSA-2025:15904
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	podman	4:4.9.4-23.module+el8.10.0+2064+309a12a4	RLSA-2025:15904
Rocky Linux:8	python-podman	0:4.9.0-3.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	python-podman	0:4.9.0-3.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	python-podman	0:4.9.0-3.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	runc	1:1.1.12-6.module+el8.10.0+1933+1fc610b1	RLSA-2025:15904
Rocky Linux:8	runc	1:1.1.12-6.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	runc	1:1.1.12-6.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	skopeo	2:1.14.5-4.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+1825+623b0c20	RLSA-2025:15904
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1896+b18fa106.rocky.0.2	RLSA-2025:15904
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1872+2e18eb19.rocky.0.2	RLSA-2025:15904
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1874+ce489889.rocky.0.2	RLSA-2025:15904
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1829+9bb2696f.rocky.0.2	RLSA-2025:15904
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2	RLSA-2025:15904
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1843+6892ab28.rocky.0.2	RLSA-2025:15904
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+2001+6a33db9f.rocky.0.2	RLSA-2025:15904
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1948+4b5cd4a9.rocky.0.2	RLSA-2025:15904
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1825+623b0c20.rocky.0.2	RLSA-2025:15904
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1880+8e896d1b.rocky.0.2	RLSA-2025:15904
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+1872+2e18eb19	RLSA-2025:15904
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+1843+6892ab28	RLSA-2025:15904
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+2001+6a33db9f	RLSA-2025:15904
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+1948+4b5cd4a9	RLSA-2025:15904
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+1896+b18fa106	RLSA-2025:15904
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+1880+8e896d1b	RLSA-2025:15904
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+1825+623b0c20	RLSA-2025:15904
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+1874+ce489889	RLSA-2025:15904
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+1815+5fe7415e	RLSA-2025:15904
Ubuntu:25.10	podman	no fix listed	UBUNTU-CVE-2025-4953
Ubuntu:26.04:LTS	podman	no fix listed	UBUNTU-CVE-2025-4953
Ubuntu:26.10	podman	no fix listed	UBUNTU-CVE-2025-4953

Affected products (as reported)

Vendor	Product	Versions
	podman	0 – before *
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat OpenShift Container Platform 4.12	see references
Red Hat	Red Hat OpenShift Container Platform 4.12	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.14	see references
Red Hat	Red Hat OpenShift Container Platform 4.15	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.17	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references

Weakness: CWE-378 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

RHSA-2024:8690 vendor-advisory, x_refsource_REDHAT
RHSA-2025:15904 vendor-advisory, x_refsource_REDHAT
RHSA-2025:16724 vendor-advisory, x_refsource_REDHAT
RHSA-2025:16729 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17669 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22265 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22275 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22695 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22724 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22732 vendor-advisory, x_refsource_REDHAT
RHSA-2025:23113 vendor-advisory, x_refsource_REDHAT
RHSA-2025:2703 vendor-advisory, x_refsource_REDHAT
RHSA-2026:0316 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-4953 vdb-entry, x_refsource_REDHAT
RHBZ#2367235 issue-tracking, x_refsource_REDHAT
https://github.com/containers/podman/pull/25173