# CVE-2025-11395: Podman: arbitrary file write when importing oci archive

Status: published. Published: 2026-09-15. Updated: 2026-11-02.

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

## Remediation

- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (buildah): ≥ 2:1.43.1-7.el10_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10 (skopeo): ≥ 2:1.22.2-6.el10_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10 (podman): ≥ 7:5.8.2-12.el10_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (buildah): ≥ 2:1.43.3-2.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (skopeo): ≥ 2:1.22.2-8.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (podman): ≥ 6:5.8.2-8.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (buildah): ≥ 2:1.43.4-2.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (skopeo): ≥ 2:1.22.2-9.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (buildah): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (container-tools:rhel8/podman): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (skopeo): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (podman): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (buildah): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (podman): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (rhcos): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (skopeo): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Dev Spaces (devspaces/udi-base-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Dev Spaces (devspaces/udi-rhel9): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L; source: CNA: redhat

- CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.44% as of 2026-11-01; percentile 38.00%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-277

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:70640 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:70641 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:88262 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:89761 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:90362 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:90424 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:90462 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:93464 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2025-11395 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2402034 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:70640 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:70641 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:88262 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:89761 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:90362 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:90424 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:90462 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:93464 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2025-11395 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2402034 (secalert@redhat.com)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2025-11395; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-11395; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2025-11395; retrieved 2026-11-02; source updated Not reported

Revision: fb0625eaa92581b370c884b606f449d5aea08259c42821805d4b2ec14236ddae

Canonical: https://y2.dev/cve/CVE-2025-11395