CVE-2026-55686CWE-61

Podman: WORKDIR symlink traversal vulnerability

Medium · published June 26, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-06-26T16:30Z
EPSS history
Timeline
  • 26 JUN 16:30Z
    Podman: WORKDIR symlink traversal vulnerability
    cvelistv5