CVE catalog

CVE-2026-79705

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and

[CVE catalog]

Severity
Medium · CVSS 4.5CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.41% · Oct 25, 2026

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-containers-buildahsid1.43.2+ds1-3vulnerable
Debiangolang-github-containers-buildahforky1.43.2+ds1-3vulnerable
Debiangolang-github-containers-buildahtrixie1.39.3+ds1-1vulnerable
Debiangolang-github-containers-buildahbookworm1.28.2+ds1-3+deb12u1vulnerable
Ubuntugolang-github-containers-buildah22.041.21.3+ds1-1ubuntu1vulnerable
Ubuntugolang-github-containers-buildah22.041.23.1+ds1-2vulnerable
Ubuntugolang-github-containers-buildahpro1.39.3+ds1-1syncable1vulnerable
Ubuntugolang-github-containers-buildahpro1.42.1+ds1-2vulnerable
Ubuntugolang-github-containers-buildahpro1.42.1+ds1-2build1vulnerable
Ubuntugolang-github-containers-buildahpro1.42.1+ds1-2ubuntu0.26.04.1~esm1vulnerable
Ubuntugolang-github-containers-buildah26.101.42.1+ds1-2build1vulnerable
Ubuntugolang-github-containers-buildah26.101.43.2+ds1-3vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-containers-buildahsourcesid(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-containers-buildahsourceforky(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-containers-buildahsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-containers-buildahsourcebookworm(unfixed)not yet assignedNot reportedNot reported

Notes

[trixie] golang-github-containers-buildah: Minor issue [bookworm] golang-github-containers-buildah: Limited support, minor issue, uncommon use case

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [buildah]Affected

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.28.2+ds1-3+deb12u1+b3 · amd64 · bookworm

      Affected

      nvd · golang-github-containers-buildah · debian · bookworm; nvd · golang-github-containers-buildah · debian · 12

    • 1.28.2+ds1-3+deb12u1+b3 · arm64 · bookworm

      Affected

      nvd · golang-github-containers-buildah · debian · bookworm; nvd · golang-github-containers-buildah · debian · 12

  • [golang-github-containers-buildah-dev]Affected

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.28.2+ds1-3+deb12u1 · all · bookworm

      Affected

      nvd · golang-github-containers-buildah · debian · bookworm; nvd · golang-github-containers-buildah · debian · 12

    • 1.28.2+ds1-3+deb12u1 · all · bookworm

      Affected

      nvd · golang-github-containers-buildah · debian · bookworm; nvd · golang-github-containers-buildah · debian · 12

[Debian 13 (Trixie)]

  • [buildah]Affected

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.39.3+ds1-1+b7 · amd64 · trixie

      Affected

      nvd · golang-github-containers-buildah · debian · 13

    • 1.39.3+ds1-1+b7 · arm64 · trixie

      Affected

      nvd · golang-github-containers-buildah · debian · 13

  • [golang-github-containers-buildah-dev]Affected

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.39.3+ds1-1 · all · trixie

      Affected

      nvd · golang-github-containers-buildah · debian · 13

    • 1.39.3+ds1-1 · all · trixie

      Affected

      nvd · golang-github-containers-buildah · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]