CVE-2026-79705
MEDIUM
NVD
CVSS Score
4.5
Severity
MEDIUM
Published
Sep 15, 2026
Vendor
unknown
Description
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.