CVE-2019-10152: Path Traversal Vulnerability in github.com/containers/podman
Summary
CVE-2019-10152: Podman Path Traversal Vulnerability leads to arbitrary file read/write in github.com/containers/podman. Affects github.com/containers/podman versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/containers/podman is an open-source Go package that provides a command-line interface for managing pods, containers, and container images. It is widely used for containerization and orchestration purposes. However, a path traversal vulnerability has been discovered in this package, which allows an attacker to read or write arbitrary files on the system.
Vulnerability Detail
The path traversal vulnerability in github.com/containers/podman arises due to insufficient input validation. An attacker can manipulate file paths to access files outside the intended directory, potentially leading to unauthorized access, information disclosure, or even remote code execution. This vulnerability can have severe consequences, as it allows an attacker to compromise the integrity and confidentiality of the system.
How To Fix
Latest published version: v1.4.2 as of 22 Oct 2026
go get github.com/containers/podman@v1.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.0
This is the first release that contains the fix.
go get github.com/containers/podman@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization techniques to prevent path traversal attacks. It is crucial to ensure that user-supplied file paths are properly validated and restricted to the intended directory. Additionally, access controls and permissions should be enforced to limit the impact of a potential exploitation.
Conclusion
The path traversal vulnerability in github.com/containers/podman poses a significant risk to the security and integrity of affected systems. It is crucial to update to version 1.4.0 or later to mitigate this vulnerability. Additionally, implementing input validation and access controls can provide an extra layer of protection. Regular monitoring and vulnerability scanning using tools like Vulert can help ensure the ongoing security of your software.
See every vulnerability recorded for github.com/containers/podman →
FAQ
This vulnerability allows an attacker to read or write arbitrary files on the system, potentially leading to unauthorized access, information disclosure, or remote code execution.
No, versions prior to 1.4.0 are affected. Updating to version 1.4.0 or later mitigates the vulnerability.
At the time of this report, there is no known public exploit for this vulnerability. However, it is essential to apply the recommended fixes to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely if the affected application is exposed to the internet or accessible by an attacker.
You can use Vulert (https://vulert.com) to monitor and alert in real-time for open-source vulnerabilities in your software. Vulert analyzes your Gopkg.lock file and provides insights into the vulnerabilities affecting your application.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/podman.
