CVE-2026-55686
Podman: WORKDIR symlink traversal vulnerability in github.com/containers/podman
5.3
MEDIUM
CVSS 3.1
EPSS 0.32%
Description
Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.
How to fix CVE-2026-55686
To remediate CVE-2026-55686, upgrade the affected package to a fixed version below.
- —no fix listed
- —no fix listed
- —no fix listed
- —no fix listed
- —no fix listed
- —no fix listed
- —no fix listed
- —upgrade to 5.7.1 or later
- —upgrade to 5.7.1 or later
Is CVE-2026-55686 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (9)
- from 0
- from 0
- from 0
- from 0, <= 3.4.7
- from 0
- from 0, <= 4.9.5
- from 0
- from 0, < 5.7.1
- from 0, < 5.7.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |