CVE-2026-79705

EUVD-2026-78823
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.5 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.05%
Debian logo
Debian Releases
Debian Product
Codename
golang-github-containers-buildah
bookworm
postponed
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang-github-containers-buildah
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:74861
https://access.redhat.com/security/cve/CVE-2026-79705
https://bugzilla.redhat.com/show_bug.cgi?id=2523419