---
id: CVE-2026-79705
title: A flaw was found in the buildah/copier Go package
summary: >-
  A flaw was found in the buildah/copier Go package. When used outside of
  Buildah by a non-root caller, a crafted tar archive containing malicious
  symlinks can escape the target extraction directory and create files outside
  the intended de…
severity: medium
cvss: 4.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-22
vendor: Red Hat
product: podman-main
affected:
  - podman-main (all versions)
  - ansible-automation-platform-24/eda-controller-rhel8 (all versions)
  - ansible-automation-platform-25/eda-controller-rhel8 (all versions)
  - ansible-automation-platform-26/eda-controller-rhel9 (all versions)
  - ansible-automation-platform-27/eda-controller-rhel9 (all versions)
  - python3.11-podman (all versions)
  - python3.12-podman (all versions)
  - python3x-podman (all versions)
  - python-podman (all versions)
  - buildah (all versions)
  - podman (all versions)
  - python-podman (all versions)
  - rhel10/buildah (all versions)
  - ubi10/buildah (all versions)
  - ubi10/podman (all versions)
  - 'container-tools:rhel8/buildah (all versions)'
  - 'container-tools:rhel8/podman (all versions)'
  - ubi8/buildah (all versions)
  - ubi8/podman (all versions)
  - buildah (all versions)
  - podman (all versions)
  - python-podman (all versions)
  - ubi9/buildah (all versions)
  - ubi9/podman (all versions)
  - buildah
  - openshift/ose-rhel-coreos-8 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
  - podman (all versions)
  - devspaces/udi-base-rhel10 (all versions)
  - devspaces/udi-base-rhel9 (all versions)
  - devspaces/udi-rhel9 (all versions)
  - >-
    container-native-virtualization/ocp-virt-validation-checkup-rhel9 (all
    versions)
  - quay/quay-builder-rhel8 (all versions)
  - quay/quay-builder-rhel9 (all versions)
published: '2026-09-15'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T15:17:10.540'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79705'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:74861'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-79705'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2523419'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79705.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-79705'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79705'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T17:28:09.238424Z'
epss: 0.00408
epssPercentile: 0.34878
ingestedAt: '2026-09-15T16:40:03.396Z'
patched:
  - hardened_images
---

## Overview

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79705.json)
- **RHSA-2026:74861** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:74861)