Podman Vulnerability CVE-2025-4953: Data Leakage through Bind Mounts
Summary
CVE-2025-4953: A flaw was found in Podman. Affects podman versions 5.4.2+ds1-2 – 5.6.1+ds1-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is a container management tool that allows users to create, manage, and run containers on Linux systems. It is known for its ability to run containers without requiring a daemon, making it lightweight and efficient. However, a recent vulnerability has been identified that affects Podman versions in Debian 13 and 14, which could lead to unintended data exposure during the build process.
Vulnerability Detail
A flaw was found in Podman where data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible. This vulnerability could potentially expose sensitive information or files that should remain within the container environment, posing a security risk to users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using RUN --mount=type=bind during the build process until the vulnerability is patched. Instead, consider using alternative methods for managing files within the container that do not expose them to the host system.
Conclusion
The CVE-2025-4953 vulnerability in Podman poses a significant risk by allowing sensitive data to leak from containers to the host system. Users are advised to update to the latest version of Podman to mitigate this risk and to consider workarounds until a patch is applied.
See every vulnerability recorded for podman →
FAQ
CVE-2025-4953 is a vulnerability in Podman that allows data written during the build process to be accessible on the host system, potentially leading to data leakage.
The vulnerability affects Podman versions in Debian 13 and 14.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update Podman right away, avoid using RUN --mount=type=bind in your builds as a temporary workaround.
More information can be found in the official CVE database or the source link provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for podman.
