CVE-2025-9566 – Podman: podman kube play command may overwrite host files

CVE ID : CVE-2025-9566

Published : Sept. 5, 2025, 8:15 p.m. | 1 hour ago

Description : There’s a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.

Binary-Affected: podman
Upstream-version-introduced: v4.0.0
Upstream-version-fixed: v5.6.1

Severity: 8.1 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…