CVE-2025-9566
published 2025-09-05CVE-2025-9566: There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap…
PriorityP354high8.1CVSS 3.1
AVNACLPRLUINSUCNIHAH
EPSS
1.01%
59.1th percentile
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.
Binary-Affected: podman
Upstream-version-introduced: v4.0.0
Upstream-version-fixed: v5.6.1
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libpod | < podman 5.6.1+ds1-2 (forky) | podman 5.6.1+ds1-2 (forky) |
| debian | podman | < podman 5.6.1+ds1-2 (forky) | podman 5.6.1+ds1-2 (forky) |
| github.com | containers_podman_v4 | 0 – 4.9.5 | — |
| github.com | containers_podman_v5 | >= 0 < 5.6.1 | 5.6.1 |
| msrc | azl3_libcontainers-common_20240213-3_on_azure_linux_3.0 | — | — |
| podman_project | podman | >= 0 < 5.6.1+ds1-2 | 5.6.1+ds1-2 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
osv8.1HIGH
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Podman: podman kube play command may overwrite host files
vendor_msrc·2025-09-09·CVSS 8.1
CVE-2025-9566 [HIGH] CWE-22 Podman: podman kube play command may overwrite host files
Podman: podman kube play command may overwrite host files
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Red Hat
podman: Podman kube play command may overwrite host files
vendor_redhat·2025-09-04·CVSS 8.1
CVE-2025-9566 [HIGH] CWE-22 podman: Podman kube play command may overwrite host files
podman: Podman kube play command may overwrite host files
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.
Binary-Affected: podman
Upstream-version-introduced: v4.0.0
Upstream-version-fixed: v5.6.1
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can o
Debian
CVE-2025-9566: libpod - There's a vulnerability in podman where an attacker may use the kube play comman...
vendor_debian·2025·CVSS 8.1
CVE-2025-9566 [HIGH] CVE-2025-9566: libpod - There's a vulnerability in podman where an attacker may use the kube play comman...
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1
Scope: local
bookworm: open
bullseye: open
OSV
podman kube play symlink traversal vulnerability in github.com/containers/podman
osv·2025-09-08
CVE-2025-9566 podman kube play symlink traversal vulnerability in github.com/containers/podman
podman kube play symlink traversal vulnerability in github.com/containers/podman
podman kube play symlink traversal vulnerability in github.com/containers/podman
OSV
CVE-2025-9566: There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a
osv·2025-09-05·CVSS 8.1
CVE-2025-9566 [HIGH] CVE-2025-9566: There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1
GHSA
podman kube play symlink traversal vulnerability
ghsa·2025-09-04
CVE-2025-9566 [HIGH] CWE-22 podman kube play symlink traversal vulnerability
podman kube play symlink traversal vulnerability
### Impact
The podman kube play command can overwrite host files when the kube file contains a ConfigMap or Secret volume mount and the volume already contains a symlink to a host file.
This allows a malicious container to write to arbitrary files on the host BUT the attacker only controls the target path not the contents that will be written to the file. The contents are defined in the yaml file by the end user.
### Requirements to exploit:
podman kube play must be used with a ConfigMap or Secret volume mount AND must be run more than once on the same volume. All the attacker has to do is create the malicious symlink on the volume the first time it is started. After that all following starts would follow the symlink and write to the host
OSV
podman kube play symlink traversal vulnerability
osv·2025-09-04
CVE-2025-9566 [HIGH] podman kube play symlink traversal vulnerability
podman kube play symlink traversal vulnerability
### Impact
The podman kube play command can overwrite host files when the kube file contains a ConfigMap or Secret volume mount and the volume already contains a symlink to a host file.
This allows a malicious container to write to arbitrary files on the host BUT the attacker only controls the target path not the contents that will be written to the file. The contents are defined in the yaml file by the end user.
### Requirements to exploit:
podman kube play must be used with a ConfigMap or Secret volume mount AND must be run more than once on the same volume. All the attacker has to do is create the malicious symlink on the volume the first time it is started. After that all following starts would follow the symlink and write to the host
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHBA-2025:15692https://access.redhat.com/errata/RHBA-2025:15712https://access.redhat.com/errata/RHBA-2025:16158https://access.redhat.com/errata/RHBA-2025:16163https://access.redhat.com/errata/RHEA-2025:4782https://access.redhat.com/errata/RHSA-2025:15900https://access.redhat.com/errata/RHSA-2025:15901https://access.redhat.com/errata/RHSA-2025:15904https://access.redhat.com/errata/RHSA-2025:16480https://access.redhat.com/errata/RHSA-2025:16481https://access.redhat.com/errata/RHSA-2025:16482https://access.redhat.com/errata/RHSA-2025:16488https://access.redhat.com/errata/RHSA-2025:16515https://access.redhat.com/errata/RHSA-2025:16724https://access.redhat.com/errata/RHSA-2025:17669https://access.redhat.com/errata/RHSA-2025:18217https://access.redhat.com/errata/RHSA-2025:18218https://access.redhat.com/errata/RHSA-2025:18240https://access.redhat.com/errata/RHSA-2025:19002https://access.redhat.com/errata/RHSA-2025:19041https://access.redhat.com/errata/RHSA-2025:19046https://access.redhat.com/errata/RHSA-2025:19094https://access.redhat.com/errata/RHSA-2025:19894https://access.redhat.com/errata/RHSA-2025:20909https://access.redhat.com/errata/RHSA-2025:20983https://access.redhat.com/errata/RHSA-2026:18289https://access.redhat.com/errata/RHSA-2026:18722https://access.redhat.com/errata/RHSA-2026:8211https://access.redhat.com/security/cve/CVE-2025-9566https://bugzilla.redhat.com/show_bug.cgi?id=2393152https://github.com/containers/podman/commit/43fbde4e665fe6cee6921868f04b7ccd3de5ad89https://github.com/containers/podman/security/advisories/GHSA-wp3j-xq48-xpjw
2025-09-05
Published