A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command,
    they can create files on the host machine with the privileges of the user running Podman. (CVE-2025-11395)

  - A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout
    header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary
    file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
    (CVE-2026-79699)

  - A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a
    crafted tar archive containing malicious symlinks can escape the target extraction directory and create
    files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
    (CVE-2026-79705)

  - Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats
    an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and
    silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-
    controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are
    not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions
    5.8.8 and 6.1.3. (CVE-2026-94603)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 050e54b4-b81e-11f1-b540-589cfc10a551 advisory.

    The Podman developers report:
    This release addresses (CVE-2025-11395), where importing images               containing crafted layer tarballs with the podman load command, or               importing volumes containing crafted symlinks with podman volume               import, allows overwriting files on the host.
    This release also addresses CVE-2026-79699 and CVE-2026-79705,               though we do not believe these CVEs are exploitable through the               Podman command line.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a     crafted tar archive containing malicious symlinks can escape the target extraction directory and create     files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
    (CVE-2026-79705)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
448495	Alpine: multiple podman packages: security update to 5.8.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
448495	Alpine: multiple podman packages: security update to 5.8.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
349791	FreeBSD : podman -- vulnerabilities (050e54b4-b81e-11f1-b540-589cfc10a551)	Nessus	FreeBSD Local Security Checks	Local	medium
345962	Linux Distros Unpatched Vulnerability : CVE-2026-79705	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-79705

medium

Tenable Plugins

critical

critical

medium

medium