CVE-2026-79705

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

This flaw allows a directory escape via crafted tar symlinks when a macOS Podman remote client performs podman cp against a malicious Podman system service server. Exploitation requires interaction with a malicious server and is not applicable to typical container deployments on Red Hat Enterprise Linux.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should ensure that podman cp operations are only performed against trusted Podman system service servers. Copying content from untrusted sources may expose the client to directory traversal vulnerabilities.