CVE-2024-1753High· 8.6▾ MidnightPoC availableA flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the ro…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Exploit / PoC code exists
Last analysed / modified upstream
A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/containers/podman/v4 < 4.9.4github.com/containers/podman/v5 < 5.0.1Patched in:
github.com/containers/podman/v4 4.9.4github.com/containers/podman/v5 5.0.1Source: https://osv.dev/vulnerability/GHSA-874v-pj72-92f3
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115378Medium· 5.8github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull (CVE-2026-115378)
CVE-2026-108119Medium· 6.3A flaw was found in busybox
CVE-2025-11395Medium· 5.5A flaw was found in Podman
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-106071Low· 3.6nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)