Podman Patches Symlink Traversal Vulnerability in kube play Command (CVE-2025-9566)

The Podman project has issued a security advisory warning of a high-severity vulnerability in the container management tool’s kube play command. Tracked as CVE-2025-9566 (CVSS 8.1), the flaw could allow malicious containers to overwrite arbitrary host files through a symlink traversal attack.

According to the advisory, “The podman kube play command can overwrite host files when the kube file contains a ConfigMap or Secret volume mount and the volume already contains a symlink to a host file.”

The vulnerability arises when kube play is used to start Kubernetes YAML configurations that mount ConfigMaps or Secrets into volumes. If a container creates a malicious symlink in the mounted volume, subsequent runs of kube play will follow the symlink and overwrite files on the host system.

While the attacker does not control the file contents (these are defined in the YAML file by the end user), they do control the target path of the overwritten file—creating opportunities for denial of service or tampering with critical host configurations.

To exploit CVE-2025-9566, several conditions must be met:

• Podman kube play must be run with a ConfigMap or Secret volume mount.
• The command must be executed more than once on the same volume.
• A malicious symlink must already exist in the volume after the first run.

The advisory explains, “All the attacker has to do is create the malicious symlink on the volume the first time it is started. After that all following starts would follow the symlink and write to the host location.”

The Podman team has released a patch in Podman v5.6.1, which addresses the symlink traversal issue.

For users unable to immediately upgrade, a temporary workaround is to avoid using kube play with ConfigMap or Secret volume mounts. As the advisory notes, “Don’t use podman kube play with ConfigMap or Secret volume mounts.”

Related Posts:

• Podman and Buildah Vulnerable to Container Breakout – CVE-2024-11218
• CVE-2024-1753: Podman/Buildah Vulnerability Allow Container Escapes
• CVE-2023-32191 (CVSS 10) in Rancher Kubernetes Engine Exposes Sensitive Credentials
• iOS 26 Password App Gains Major Upgrade: View Full History of Saved Credentials