CVE-2025-4953: Podman: build context bind mount
A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.
Other sources
In the Dockerfile I added "sleep 300". After 300 seconds the build context directory will be deleted by Podman but before that an unprivileged user on the host has access to a file that has permissions 4777
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4953?
The severity of CVE-2025-4953 is currently rated as moderate due to the potential for data leakage.
How do I fix CVE-2025-4953?
To fix CVE-2025-4953, you should upgrade to the latest version of Red Hat Podman that addresses this vulnerability.
What type of software is affected by CVE-2025-4953?
CVE-2025-4953 affects Red Hat Podman, particularly in scenarios involving RUN --mount=type=bind mounts.
What are the potential consequences of CVE-2025-4953?
The potential consequence of CVE-2025-4953 includes unauthorized files being exposed on the host system from container builds.
Is there a workaround for CVE-2025-4953 until a fix is applied?
As a temporary workaround for CVE-2025-4953, avoid using RUN --mount=type=bind in your Containerfiles until the vulnerability is resolved.