Skip to content
Red HatCVE-2026-79705

Red Hat buildah/copier Go: path traversal

Medium4.5CVE-2026-79705 · Published Sep 15, 2026 · updated Sep 16, 2026

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

Red Hat advisory

Affected versions

PackageAffectedFixed in
Red Hat Ansible Automation Platform 2
Product
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
Red Hat Enterprise Linux 10
Product
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-22

More Red Hat advisories

All Red Hat
Advisory
Red Hat Podman: insecure permissions
Medium5.5Sep 15
Red Hat file-psd plugin: integer overflow
High7.8Sep 15
Red Hat tftp-hpa.: out-of-bounds read
High7.5Sep 15
Red Hat containers/storage: link following
Medium4.4Sep 15
Red Hat environment-modules: command injection
High7.3Sep 15
Red Hat Enterprise Linux 8: denial of service
Low3.7Sep 15

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.