CVE-2025-0750: CRI-O Path Traversal Vulnerability Leading to Node-Level Denial of Service
Summary
CVE-2025-0750: CRI-O Path Traversal vulnerability. Affects github.com/cri-o/cri-o versions < 1.33.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CRI-O is an open-source container runtime specifically designed for Kubernetes. It provides a lightweight and efficient way to manage container lifecycles, including image management, pod management, and logging. The package is widely used in cloud-native environments, making it crucial for maintaining the security and stability of containerized applications. However, CRI-O has a vulnerability that could allow unauthorized access to critical system paths, posing a significant risk to the host system.
Vulnerability Detail
A path traversal vulnerability exists in CRI-O's log management functions, specifically in UnMountPodLogs and LinkContainerLogs. This issue arises when an attacker with permissions to create and delete Pods can exploit the vulnerability to unmount arbitrary host paths. The potential ramifications include a node-level denial of service, as critical system directories could be unmounted, leading to system instability and potential data loss. The vulnerability is classified under CWE-22, indicating its nature as a path traversal issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict permissions for users who can create and delete Pods to mitigate the risk of exploitation. Additionally, monitor the logs for any suspicious activities related to pod management.
Conclusion
The CRI-O path traversal vulnerability (CVE-2025-0750) poses a significant risk to containerized applications by allowing attackers to unmount critical system paths. It is essential to update to the latest patched version of CRI-O and implement necessary workarounds to mitigate the risk. Utilizing tools like Vulert can further enhance your security posture by providing real-time vulnerability monitoring.
See every vulnerability recorded for github.com/cri-o/cri-o →
FAQ
The CVSS score for this vulnerability is 6.6, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The vulnerability can lead to node-level denial of service by allowing an attacker to unmount critical system directories.
Yes, a patched version of CRI-O is available. It is recommended to update to a version beyond 1.33.0.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just Gopkg.lock, helping you maintain the security of your software.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cri-o/cri-o.
