CVE-2025-9566: Symlink Traversal Vulnerability in Podman Packages
Summary
CVE-2025-9566: podman kube play symlink traversal vulnerability in github.com/containers/podman. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- libpod · Debian:11
- github.com/containers/podman/v5 · Go
The same CVE-2025-9566 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is an open-source container management tool that allows users to manage containers and pods without requiring a daemon. It is designed to be a drop-in replacement for Docker, providing similar functionality with a focus on security and simplicity. The tool supports various container operations, including building, running, and managing containerized applications. However, a vulnerability has been identified in the Podman packages that could potentially allow unauthorized access to sensitive files through symlink traversal.
Vulnerability Detail
The vulnerability, identified as CVE-2025-9566, arises from a flaw in the 'podman kube play' command, which does not properly validate symlink paths. This oversight can be exploited by an attacker to traverse directories and access files outside the intended directory structure. The ramifications of this vulnerability could include unauthorized access to sensitive data, leading to data leaks or further exploitation of the system. It is crucial for users of Podman to understand the risks associated with this vulnerability and take appropriate action to mitigate them.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive directories and files or avoid using the 'podman kube play' command until the package is updated. Additionally, ensure that proper file permissions are set to limit access.
Conclusion
The CVE-2025-9566 vulnerability in Podman packages poses a significant risk due to its potential for unauthorized file access. Users are strongly advised to update to the patched version 5.6.1 or later and to implement security best practices in the meantime. Awareness and prompt action are essential to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for github.com/containers/podman →
FAQ
CVE-2025-9566 is a symlink traversal vulnerability found in the Podman packages that allows unauthorized access to files outside the intended directory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you are unable to update, consider implementing strict file permissions and avoiding the use of the vulnerable command until a fix is applied.
The risks include unauthorized access to sensitive files, which could lead to data leaks or further exploitation of the system.
You can visit the official Podman GitHub repository or check vulnerability databases like Vulert for real-time alerts and monitoring.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/podman.
