CVE-2025-9566

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1
References
Link Resource
https://access.redhat.com/errata/RHBA-2025:15692
https://access.redhat.com/errata/RHBA-2025:15712
https://access.redhat.com/errata/RHBA-2025:16158
https://access.redhat.com/errata/RHBA-2025:16163
https://access.redhat.com/errata/RHEA-2025:4782
https://access.redhat.com/errata/RHSA-2025:15900
https://access.redhat.com/errata/RHSA-2025:15901
https://access.redhat.com/errata/RHSA-2025:15904
https://access.redhat.com/errata/RHSA-2025:16480
https://access.redhat.com/errata/RHSA-2025:16481
https://access.redhat.com/errata/RHSA-2025:16482
https://access.redhat.com/errata/RHSA-2025:16488
https://access.redhat.com/errata/RHSA-2025:16515
https://access.redhat.com/errata/RHSA-2025:16724
https://access.redhat.com/errata/RHSA-2025:17669
https://access.redhat.com/errata/RHSA-2025:18217
https://access.redhat.com/errata/RHSA-2025:18218
https://access.redhat.com/errata/RHSA-2025:18240
https://access.redhat.com/errata/RHSA-2025:19002
https://access.redhat.com/errata/RHSA-2025:19041
https://access.redhat.com/errata/RHSA-2025:19046
https://access.redhat.com/errata/RHSA-2025:19094
https://access.redhat.com/errata/RHSA-2025:19894
https://access.redhat.com/errata/RHSA-2025:20909
https://access.redhat.com/errata/RHSA-2025:20983
https://access.redhat.com/errata/RHSA-2026:18289
https://access.redhat.com/errata/RHSA-2026:18722
https://access.redhat.com/errata/RHSA-2026:8211
https://access.redhat.com/security/cve/CVE-2025-9566
https://bugzilla.redhat.com/show_bug.cgi?id=2393152
https://github.com/containers/podman/commit/43fbde4e665fe6cee6921868f04b7ccd3de5ad89
https://github.com/containers/podman/security/advisories/GHSA-wp3j-xq48-xpjw
Configurations

No configuration.

History

19 May 2026, 14:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:18722 -

19 May 2026, 10:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:18289 -

19 Apr 2026, 20:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:8211 -

19 Mar 2026, 18:16

Type Values Removed Values Added
References
  • () https://github.com/containers/podman/commit/43fbde4e665fe6cee6921868f04b7ccd3de5ad89 -
  • () https://github.com/containers/podman/security/advisories/GHSA-wp3j-xq48-xpjw -

16 Feb 2026, 14:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHBA-2025:16163 -

16 Feb 2026, 09:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHBA-2025:15692 -
  • () https://access.redhat.com/errata/RHBA-2025:15712 -
  • () https://access.redhat.com/errata/RHEA-2025:4782 -
  • () https://access.redhat.com/errata/RHSA-2025:17669 -

09 Feb 2026, 20:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:16724 -

09 Feb 2026, 16:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHBA-2025:16158 -

13 Nov 2025, 10:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:19894 -

11 Nov 2025, 21:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:20983 -

11 Nov 2025, 14:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:20909 -

30 Oct 2025, 07:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:19002 -

30 Oct 2025, 06:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:19041 -

29 Oct 2025, 13:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:19046 -

24 Oct 2025, 00:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:18240 -

23 Oct 2025, 21:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:19094 -

22 Oct 2025, 07:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:18217 -

22 Oct 2025, 06:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:18218 -

23 Sep 2025, 22:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:16488 -
  • () https://access.redhat.com/errata/RHSA-2025:16515 -

23 Sep 2025, 17:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:16481 -

23 Sep 2025, 16:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:16482 -

23 Sep 2025, 14:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:16480 -

16 Sep 2025, 12:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:15900 -
  • () https://access.redhat.com/errata/RHSA-2025:15901 -
  • () https://access.redhat.com/errata/RHSA-2025:15904 -

05 Sep 2025, 20:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-09-05 20:15

Updated : 2026-06-25 03:16


NVD link : CVE-2025-9566

Mitre link : CVE-2025-9566

CVE.ORG link : CVE-2025-9566


JSON object : View

Products Affected

No product.

CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')