Podman: Schwachstelle ermöglicht Manipulation von Dateien
WID-SEC-2025-1974 · first 05.09.2025 · updated 28.09.2026 · CVSS 8,1
What it is about
Podman ist ein Container-Laufzeit- und Management-Tool, mit dem Benutzer Container ausführen und verwalten können, ohne einen separaten Daemon-Prozess zu benötigen. Podman is a container runtime and management tool that allows users to run and manage containers without the need for a separate daemon process. Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Podman ausnutzen, um Dateien zu manipulieren.
Under what conditions?
Over the network, but only with valid access (login required), for example with stolen credentials or as an insider.
What can happen in the worst case
An attacker could use the vulnerability to
- Dateien zu manipulieren
Am I affected?
Affected according to the BSI:
- Red Hat Enterprise Linux
- Fedora Linux
- SUSE Linux
- Oracle Linux
- SUSE openSUSE
- RESF Rocky Linux
- Red Hat OpenShift Container Platform
- Open Source Podman <5.6.1
- Red Hat OpenShift Container Platform <4.18.27
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Podman 5.6.1
- Red Hat OpenShift Container Platform 4.18.27
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- GitHub Advisory Database vom 2025-09-04 github.com
- Red Hat Bugtracker vom 2025-09-04 bugzilla.redhat.com
- Fedora Security Advisory FEDORA-2025-F9E142A4B0 vom 2025-09-05 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-B93734B6B8 vom 2025-09-05 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-19F7DD07D9 vom 2025-09-05 bodhi.fedoraproject.org
- Red Hat Security Advisory RHSA-2025:15900 vom 2025-09-16 access.redhat.com
- Red Hat Security Advisory RHSA-2025:15901 vom 2025-09-16 access.redhat.com
- Red Hat Security Advisory RHSA-2025:15904 vom 2025-09-16 access.redhat.com
- Oracle Linux Security Advisory ELSA-2025-15901 vom 2025-09-17 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2025-15900 vom 2025-09-16 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2025-15904 vom 2025-09-17 linux.oracle.com
- Red Hat Security Advisory RHSA-2025:16481 vom 2025-09-23 access.redhat.com
- Red Hat Security Advisory RHSA-2025:16482 vom 2025-09-23 access.redhat.com
- Red Hat Security Advisory RHSA-2025:16488 vom 2025-09-23 access.redhat.com
- Red Hat Security Advisory RHSA-2025:16515 vom 2025-09-24 access.redhat.com
- Red Hat Security Advisory RHSA-2025:16480 vom 2025-09-23 access.redhat.com
- Rocky Linux Security Advisory RLSA-2025:15900 vom 2025-10-10 errata.build.resf.org
- SUSE Security Update SUSE-SU-2025:03534-1 vom 2025-10-10 lists.suse.com
- SUSE Security Update SUSE-SU-2025:03584-1 vom 2025-10-13 lists.opensuse.org
- Red Hat Security Advisory RHSA-2025:18218 vom 2025-10-22 access.redhat.com
- Red Hat Security Advisory RHSA-2025:18217 vom 2025-10-22 access.redhat.com
- Red Hat Security Advisory RHSA-2025:18240 vom 2025-10-23 access.redhat.com
- Red Hat Security Advisory RHSA-2025:19094 vom 2025-10-24 access.redhat.com
- SUSE Security Update SUSE-SU-2025:3782-1 vom 2025-10-24 lists.opensuse.org
- SUSE Security Update SUSE-SU-2025:20869-1 vom 2025-10-27 lists.suse.com
and 26 more sources in the original advisory
CVE: CVE-2025-9566
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.