CVE-2026-79699: 
Podman vulnerability analysis and mitigation

CVE-2026-79699 is a path traversal vulnerability in the containers/storage library affecting tools such as Podman, Buildah, and Skopeo. A crafted tar archive containing a malicious whiteout header (e.g., victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer. The vulnerability was published on September 15, 2026, and is currently awaiting full NVD analysis. It carries a CVSS v3.1 base score of 4.4 (Medium) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-59 (Improper Link Resolution Before File Access / 'Link Following'). During container image layer extraction, the containers/storage library does not properly validate whiteout headers in tar archives — whiteout files are used in overlay filesystems to mark deleted files. An attacker can craft a tar archive with a whiteout entry such as victim/.wh. that, when processed, causes the library to replace the target extraction directory with an arbitrary file rather than simply deleting it. Exploitation requires local access and user interaction (i.e., a user or process must process the malicious tar archive), and no privileges are required. According to Red Hat, the flaw primarily impacts external applications that directly call the containers/storage library API, rather than Red Hat container tools themselves (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation can result in low-integrity and low-availability impacts: an attacker can replace an extraction destination directory with an arbitrary file, potentially overwriting critical system files or injecting malicious content during container image layer application. This could compromise container integrity and, in certain configurations, host security. Confidentiality is not directly impacted, and the scope is unchanged, limiting blast radius to the affected component (Red Hat CVE, Github Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation as of the time of publication. The Red Hat Bugzilla entry notes that a Go test case demonstrating the issue (calling UnpackLayer with a victim/.wh. whiteout entry) was reported by the upstream Podman team, and a patch was available upstream but not yet released at the time of filing. The EPSS score is approximately 0.13–0.17%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and NVD SSVC assessment classifies exploitation as 'none' (Red Hat Bugzilla, Github Advisory).

1. Craft malicious tar archive: Create a tar archive containing a whiteout entry with a path such as victim/.wh. designed to target a directory that will exist at the extraction destination.
2. Deliver the archive: Distribute the malicious tar archive as a container image layer or supply it to a system where a vulnerable application directly calls the containers/storage library API (e.g., a custom tool using UnpackLayer, ApplyLayer, or ApplyUncompressedLayer).
3. Trigger extraction: Induce a user or automated process to extract the malicious archive using the vulnerable library functions. This requires user interaction — for example, pulling or importing a container image.
4. Directory replacement: During extraction, the library improperly resolves the whiteout header, replacing the victim extraction destination directory with an arbitrary file specified by the attacker, potentially overwriting system files or injecting malicious content (Red Hat CVE, Red Hat Bugzilla).

• File System: Unexpected replacement of directories with regular files in container image extraction paths; directories that should exist appearing as files after image layer extraction.
• Logs: Errors or anomalies in container runtime logs (e.g., Podman, Buildah, Skopeo) during image pull or layer application referencing unexpected file types at extraction destinations.
• Process: Unusual behavior from container tools (Podman, Buildah, Skopeo) when processing externally sourced container images, particularly those with non-standard layer structures.

Red Hat has stated that no mitigation is currently available that meets its criteria for ease of use, deployment, and stability. A patch was developed upstream by the Podman team and is expected to be incorporated into future releases of the containers/storage library and dependent tools (Podman, Buildah, Skopeo). Organizations should avoid processing untrusted or externally sourced container image tar archives with applications that directly call the containers/storage library API, and should monitor for updated package releases from Red Hat and upstream. The deadline for a fix noted in the Bugzilla entry is November 25, 2026 (Red Hat CVE, Red Hat Bugzilla).