A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command,
    they can create files on the host machine with the privileges of the user running Podman. (CVE-2025-11395)

  - A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout
    header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary
    file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
    (CVE-2026-79699)

  - A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a
    crafted tar archive containing malicious symlinks can escape the target extraction directory and create
    files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
    (CVE-2026-79705)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 050e54b4-b81e-11f1-b540-589cfc10a551 advisory.

    The Podman developers report:
    This release addresses (CVE-2025-11395), where importing images               containing crafted layer tarballs with the podman load command, or               importing volumes containing crafted symlinks with podman volume               import, allows overwriting files on the host.
    This release also addresses CVE-2026-79699 and CVE-2026-79705,               though we do not believe these CVEs are exploitable through the               Podman command line.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout     header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary     file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
    (CVE-2026-79699)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
448495	Alpine: multiple podman packages: security update to 5.8.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
448495	Alpine: multiple podman packages: security update to 5.8.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
349791	FreeBSD : podman -- vulnerabilities (050e54b4-b81e-11f1-b540-589cfc10a551)	Nessus	FreeBSD Local Security Checks	Local	medium
345954	Linux Distros Unpatched Vulnerability : CVE-2026-79699	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-79699

medium

Tenable Plugins

medium

medium

medium

medium