CVE-2019-10152
podman: Improper symlink resolution allows access to host files when executing `podman cp` on running containers
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · May 29, 2019
Updated · February 21, 2026
Description
A path traversal vulnerability has been discovered in podman in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.
Statement
This issue does not affect the versions of podman as shipped with OpenShift Container Platform 4.1 or Red Hat Enterprise Linux 8 as they do not include support for the cp command.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 7.5CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE-59 · Improper Link Resolution Before File Access ('Link Following')