Critical Vulnerability in Podman: Potential Host File Overwrite via Kube Play Command
Summary
UBUNTU-CVE-2025-9566: There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a h... Affects libpod versions 4.3.1+ds1-8 – 4.9.3+ds1-1ubuntu0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is an open-source container management tool that enables users to manage containers and images without requiring a daemon. It is designed to be a drop-in replacement for Docker, providing similar functionality with a focus on security and simplicity. The affected versions of Podman (4.9.3 and 5.4.1) have a vulnerability that allows attackers to exploit symbolic links in volume mounts, leading to potential overwriting of host files.
Vulnerability Detail
The vulnerability arises from the kube play command in Podman, where an attacker can manipulate a kube file that contains a Secret or ConfigMap volume mount. If this volume contains a symbolic link pointing to a host file path, the attacker can overwrite the target file. While the attacker can control which file is overwritten, they cannot dictate the content written into it. This vulnerability poses a significant risk as it can lead to unauthorized modifications of critical files on the host system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using symbolic links in volume mounts for Secrets or ConfigMaps until the package is updated. Instead, consider using direct file paths or other secure methods to manage sensitive data.
Conclusion
The vulnerability in Podman allows for potential overwriting of host files through the kube play command, posing a significant risk to system integrity. Users are strongly advised to update to the patched version to mitigate this risk and implement the suggested workarounds until the update can be applied.
See every vulnerability recorded for libpod →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
The affected versions of Podman are 4.9.3 and 5.4.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, avoid using symbolic links in volume mounts for Secrets or ConfigMaps as a temporary workaround.
More information can be found in the official Ubuntu security notices at https://github.com/canonical/ubuntu-security-notices.
Related vulnerabilities
Recent vulnerabilities recorded for libpod.
