CVE-2025-4953

Podman: build context bind mount

HIGH 7.4

At a glance

Source: NVD
EPSS: EPSS 0.64 % · percentile 50 (2026-10-28)
State: PUBLISHED
Published: 2025-09-16 14:54 UTC
Updated: 2026-10-14 17:27 UTC
Assigner: redhat
NVD status: Deferred

Description

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.

Weaknesses (CWE)

CWE-378 — Creation of Temporary File With Insecure Permissions

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	redhat
CVSS 3.1	HIGH 7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	NVD · secalert@redhat.com (Secondary)

Advisories

GHSA-m68q-4hqr-mc6f — Podman Creates Temporary File with Insecure Permissions
GO-2025-3961 — Podman Creates Temporary File with Insecure Permissions in github.com/containers/podman

European references

ENISA EUVD · EUVD-2025-29612
GCVE · GCVE-0-2025-4953

Affected products

Product	Versions
podman	affected 0 < *
Red Hat · Red Hat Enterprise Linux 8	unaffected 8100020250911075811.afee755d < *
Red Hat · Red Hat OpenShift Container Platform 4.12	unaffected 3:4.2.0-15.rhaos4.12.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.12	unaffected 412.86.202601061735-0 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 1:1.29.1-5.rhaos4.13.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 3:2.1.7-5.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 1:1.4.0-5.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:1.26.5-26.rhaos4.13.giteb3d487.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:1.26.0-7.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:2.2.24-5.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:2.15.0-10.rhaos4.13.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202410181847.p0.g53fd427.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202410181847.p0.gd2acdd5.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202410181847.p0.g1397e80.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202410181847.p0.gd192e90.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202410181847.p0.g36754b7.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 3:4.4.1-15.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 4:1.1.14-2.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 2:1.11.3-4.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 1:1.29.5-1.rhaos4.13.el8 < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD