Skip to content
Patch Next
Sign inAdd to your agent

← Actionable
Medium, CVSS 5.3amended

Podman: WORKDIR symlink traversal vulnerability

CVE-2026-55686GHSA-q6r4-3wmg-fwcq

What to do

Partial vendor fix. Follow the primary source's mitigation guidance and check back for a fix.

This page has no inventory attached, so it cannot say whether you are affected. A vendor fix is not proof that your deployment is fixed.

Add to your agent

Affected packages

  • Go github.com/containers/podman/v5

    Affected
    < 5.7.1
    Fixed in
    5.7.1

  • Go github.com/containers/podman/v3

    Affected
    <= 3.4.7
    Fixed in
    no fixed version recorded

  • Go github.com/containers/podman/v4

    Affected
    <= 4.9.5
    Fixed in
    no fixed version recorded

Sources

Severity and exploitation
Exploitation
No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.
CVSS
5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS
  • CVE-2026-55686: 0.40% estimated exploitation activity in the next 30 days; percentile 34.60 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.
Source description

As published by the source; long descriptions are shortened.

Summary Running a malicous container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition.

Patch https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0

Details This issue was fixed in podman 5.7.1 (git commit 7ce2e00ab140c11a68301f0b161f51984131a858)

PoC The reproducer script _test1.bash_ demonstrates the vulnerability. The directory `/var/BREAKOUT` is created on the host. The container process uses the container directory `/var/BREAKOUT` as current working directory. The reproducer script _test2.bash_ demonstrates the same vulnerability. The directory `/var/BREAKOUT` is created on the host. The container process uses the container directory `/usr/local` as…

Dates and revisions
Published by the source
Last modified by the source
Source last checked
  1. Revision 3 · amended ·

    Amended from osv record GHSA-q6r4-3wmg-fwcq

  2. Revision 2 · amended ·

    Amended from ghsa record GHSA-q6r4-3wmg-fwcq

  3. Revision 1 · created ·

    Published from ghsa record GHSA-q6r4-3wmg-fwcq

Agent brief

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-55686

Advisory: Podman: WORKDIR symlink traversal vulnerability
IDs: CVE-2026-55686, GHSA-q6r4-3wmg-fwcq
Record: https://patchnext.com/advisories/cve-2026-55686 (revision 3, source checked 4 Nov 2026, 06:30 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: github.com/containers/podman/v5 5.7.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/containers/podman/v5: affected < 5.7.1; fixed in 5.7.1
- Go github.com/containers/podman/v3: affected <= 3.4.7
- Go github.com/containers/podman/v4: affected <= 4.9.5

## Suggested inspection (read-only)
- Go github.com/containers/podman/v5: check the installed version with your package manager.
- Go github.com/containers/podman/v3: check the installed version with your package manager.
- Go github.com/containers/podman/v4: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/containers/podman/v5, github.com/containers/podman/v3, github.com/containers/podman/v4.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-q6r4-3wmg-fwcq (GitHub-reviewed advisory GHSA-q6r4-3wmg-fwcq lists affected ranges: Go github.com/containers/podman/v5 >=0 =0 =0 <=3.4.7)
- Verified: https://osv.dev/vulnerability/GHSA-q6r4-3wmg-fwcq (OSV record GHSA-q6r4-3wmg-fwcq lists affected ranges: Go github.com/containers/podman/v5 >=0 =0 =0 <=3.4.7)

Commands are suggestions: review each one before running it.

Loading voting…