A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.2
References

Thu, 24 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
References

Thu, 24 Sep 2026 02:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9::appstream
References

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 15 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
Title Podman: arbitrary file write when importing oci archive
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Redhat openshift Devspaces
Weaknesses CWE-277
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/a:redhat:openshift_devspaces:3
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Redhat openshift Devspaces
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}


cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2026-09-15T22:59:03.366Z

Updated: 2026-10-22T20:43:15.052Z

Reserved: 2025-10-07T03:14:35.482Z

Link: CVE-2025-11395

cve-icon Vulnrichment

Updated: 2026-09-16T19:44:12.227Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T23:16:59.933

Modified: 2026-10-22T21:17:13.340

Link: CVE-2025-11395

cve-icon Redhat

No data.