CVE-2025-11395

Executive Summary

CVE-2025-11395 is a path-handling flaw in Podman's podman load command: an attacker who can supply a crafted tar archive to that command can cause files to be written on the host filesystem with the privileges of the user executing Podman. The vulnerability is rated CVSS 3.1 base score 5.5 (Medium), classified under CWE-277 (Insecure Inherited Permissions), and currently has no vendor patch, no public proof-of-concept, and no CISA KEV listing. Exploitation requires an adjacent/limited attack vector plus a precondition that places a malicious tar archive into the load path — typically via a poisoned image export, a shared artifact repository, or social engineering of a developer or CI pipeline — after which impact is confined to confidentiality, integrity, and availability at Low severity for each.

Technical Analysis

podman load is the Podman subcommand used to import a container image or archive previously produced by podman save. It reads a tar archive, parses its internal structure, and reconstructs image layers, manifests, and metadata on the local host. CVE-2025-11395 concerns archive extraction semantics: the NVD description states that a "crafted tar archive" passed to podman load allows an attacker to "create files on the host machine with the privileges of the user running Podman."

The vulnerability class here is directory/path traversal during archive extraction — the same family that encompasses tar "Zip Slip" issues and the well-known container escape surface around archive handling. When an archiver extracts member entries, each entry's path is resolved relative to a destination directory. If the extracting code does not canonicalize and validate the final resolved path, a member named with ../ sequences (or an absolute path, or a symlink pointing outside the extraction root) can cause the write to land outside the intended destination. CWE-277 ("Insecure Inherited Permissions") frames the specific consequence: the file that gets created inherits the permissions of the invoking process — in Podman's case the unprivileged user (or, in rootful mode, root) running podman load.

The critical nuance is that the impact is bounded by the privilege of the invoking user, not escalated to root by the flaw itself. That is why the CVSS vector assigns only Low (L) to Confidentiality, Integrity, and Availability. However, "low" is not "zero": an attacker who can write arbitrary files into a user's home directory can plant shell configuration hooks (e.g., shell rc files, authorized_keys, cron entries, desktop autostart files) that execute in the user's context, pivoting to full user compromise. In rootful Podman deployments, the same primitive becomes an arbitrary root-owned file write.

The CVSS vector AV:A (Adjacent) is significant and precise. It indicates the attacker is not remote over the open internet; they must already be positioned to deliver the malicious archive into the victim's environment — through a shared network share, a co-located CI runner, a container registry consumed by the victim, or a shared filesystem. PR:L (Low privileges) and UI:N (No user interaction) mean the attacker does not need administrative access on the target and that the flaw does not depend on a user clicking through a prompt — though in practice the victim must run podman load on the attacker-supplied artifact. S:U (Scope Unchanged) confirms the vulnerable component and the impacted component are the same security authority, reinforcing that the consequence stays within the invoking user's privilege boundary.

No specific function names, module paths, or tar-entry patterns are given in the supplied data. Based on the vulnerability class, the mechanism is a failure to validate archive member paths prior to extraction; the exact code location is not available from the source data provided, and we do not speculate about it.

Exploitation Scenarios

No public PoC exists for this CVE. The attack chain below is inferred from the vulnerability class and the explicit statement in the NVD description; no implementation specifics are invented.

1. Reconnaissance / target identification. The attacker identifies a target environment that routinely consumes tar-format container images via podman load — build farms, air-gapped hosts, developer workstations, or automated image-import pipelines. The attacker does not need network reachability to a listening service; they need a distribution channel for a tar artifact.

2. Delivery — placing the crafted archive. Because the vector is AV:A, the attacker positions the malicious tar where the victim will pick it up: a shared artifact repository, a network file share, a USB/drop mechanism, a compromised upstream image export, or a messaging channel that delivers the .tar to the operator. The PR:L rating indicates the attacker needs only ordinary user-level access to that channel.

3. Trigger — the vulnerable extraction. The victim (or an automated process) runs podman load against the supplied archive. The archive contains member entries whose resolved paths escape the intended extraction root. Per the NVD description, the archive is "crafted" specifically to cause file creation outside the normal destination. At the vulnerability-class level, this is a path-traversal/tar-entry write primitive; the precise traversal encoding is not disclosed in the source data.

4. File creation on the host. Files are written to the host filesystem with the privileges of the user running Podman. In a rootless deployment this is that user; in rootful mode it is root. The writes confirm low-level integrity impact (I:L) — the attacker controls content and location of new files within the writeable scope of that user.

5. Post-exploitation — contextual escalation via planted files. The initial impact is confidential, integrity, and availability Low (C:L/I:L/A:L), but planted files in a user's environment can be weaponized: shell initialization files, SSH authorized_keys, scheduled jobs, or autostart entries that execute code the next time the user's session runs. The attacker gains persistent execution in the user's context. In a rootful Podman scenario the same primitive yields root-owned file writes, which materially expands blast radius.

Note the constraint: this flaw does not by itself grant code execution, does not cross the user privilege boundary, and has no demonstrated in-the-wild exploitation as of this report. Success depends on the attacker's ability to deliver the archive and the victim's operational use of podman load on untrusted inputs.

Impact Assessment

The CVSS 3.1 base score of 5.5 (Medium) reflects the balance between a real write primitive and tightly bounded privilege and reachability conditions:

• AV:A (Adjacent): the attacker must already be positioned near the victim's supply of artifacts — no internet-scale exploitation.
• AC:L (Low): no special conditions beyond delivering a crafted archive.
• PR:L (Low): only user-level access to the delivery channel is required.
• UI:N (None): the extraction path is assumed to run without interactive review of tar contents.
• S:U (Unchanged): impact stays inside the invoking user's security authority.
• C:L / I:L / A:L: each confidentiality, integrity, and availability impact is Low — consistent with file creation bounded by user privilege.

Business impact. Any organization that imports container images from external or semi-trusted sources — CI/CD pipelines, air-gapped transfer workflows, shared build runners, developer endpoints — is in scope. The realistic worst case is not mass compromise but targeted, persistent footholds on developer machines and build infrastructure, which are high-value pivot points. Because build farms often run automated podman load steps without human review, the UI:N dimension is operationally credible: a poisoned artifact in a shared registry or transfer directory can be extracted automatically.

Blast radius. At the low end, a single user's home directory is writable, enabling per-user persistence. At the high end, rootful Podman on a build host or shared runner lets an attacker write arbitrary root-owned files, potentially converting a low-severity file write into host-level persistence. The broad adoption of Podman across Linux distributions and the rise of rootless container workloads widen the potential exposure surface, though the supplied data does not enumerate specific affected versions, so no precise install-base estimate is possible.

Detection Guidance

Detections below target the observable behaviors of archive path traversal during podman load: anomalous file creations, tar extraction command lines, and archive member paths containing traversal sequences. They are best-effort given the absence of a disclosed PoC; tune before production.

Sigma Rule

title: Suspicious Podman Load of Archive with Path Traversal
id: 7b1c4a2e-9d3f-4f6a-8c21-2b0e5a9c1f77
status: experimental
description: Detects podman load invocation against tar archives sourced from untrusted or temporary locations, consistent with CVE-2025-11395 path traversal via crafted tar.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-11395
author: valtersit.com Threat Intelligence
date: 2025/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/podman'
    CommandLine|contains|all:
      - 'load'
      - '.tar'
  filter_trusted:
    CommandLine|contains:
      - '/var/lib/containers/'
      - '/usr/share/containers/'
  condition: selection and not filter_trusted
fields:
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Legitimate image imports from trusted internal registries staged as tar
level: medium
tags:
  - attack.t1195.002
  - cve.2025.11395

YARA Rule

rule CVE_2025_11395_Tar_Path_Traversal
{
    meta:
        description = "Detects tar archives containing member paths with directory traversal sequences potentially abusable by podman load (CVE-2025-11395)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11395"
        date = "2025-01-01"
        severity = "medium"
    strings:
        $traverse_1 = "../../"
        $traverse_2 = "../.."
        $abs_tmp = "/tmp/"
        $abs_etc = "/etc/"
        $abs_root = "/root/"
        $tar_magic = { 75 73 74 61 72 } // "ustar" tar header magic
    condition:
        $tar_magic and 2 of ($traverse_*) or (1 of ($traverse_*) and 1 of ($abs_*))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2025-11395 Possible Tar Path Traversal Payload in Container Import"; flow:to_server,established; content:"ustar"; offset:257; depth:5; content:"../"; distance:0; within:200; classtype:attempted-user; sid:2025113950; rev:1; reference:cve,2025-11395; metadata:created_at 2025_01_01, updated_at 2025_01_01;)

Elastic Detection

process where event.type == "start" and
  process.name == "podman" and
  process.command_line : ("*load*" and "*.tar*") and
  not process.command_line : ("*/var/lib/containers/*", "*/usr/share/containers/*")

Splunk SPL Query

index=linux_logs sourcetype=linux_secure OR sourcetype=sysmon_linux OR sourcetype=auditd
| search process_name=podman OR CommandLine="*podman load*"
| where match(CommandLine, "(?i)podman\s+load") AND match(CommandLine, "(?i)\.tar")
| eval risk=if(match(CommandLine, "(?i)(/tmp/|/dev/shm/|/home/)"), "high", "medium")
| table _time, host, user, CommandLine, risk
| sort - _time

Wazuh OSSEC Rule

<group name="podman,cve-2025-11395,">
  <rule id="100950" level="10">
    <decoded_as>json</decoded_as>
    <field name="command">podman</field>
    <regex type="pcre2">podman\s+load\s+.*\.tar</regex>
    <description>CVE-2025-11395: podman load of tar archive detected - potential path traversal file write</description>
    <mitre>
      <id>T1195.002</id>
      <id>T1548</id>
    </mitre>
    <group>container_security,podman,</group>
  </rule>
  <rule id="100951" level="12">
    <if_sid>100950</if_sid>
    <regex type="pcre2">(/tmp/|/dev/shm/|/home/\w+/Downloads)</regex>
    <description>CVE-2025-11395: podman load from untrusted temporary location - high risk</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor fix, or workaround has been supplied by any tracked source. The following are defense-in-depth controls, not vendor-endorsed fixes; validate against the upstream Podman project for the latest advisory.

1. Immediate mitigations.

   • Never run podman load against tar archives from untrusted or unverified sources. Treat incoming image tars as hostile input.
   • Where possible, run Podman in rootless mode so that any file write is bounded by the unprivileged user's permissions rather than root.
   • Inspect archive member listings (e.g., tar table-of-contents review) before loading, and reject archives containing traversal sequences or absolute paths.
   • Restrict write access to shared artifact locations and CI transfer directories to only those identities that require it.
   • Isolate build and image-import hosts (dedicated runners, restricted user accounts, minimal installed tooling) to bound post-exploitation persistence.

2. Patch / upgrade steps.

   • Monitor the Podman project's release notes and security advisories; apply the vendor fix as soon as a patched version is published.
   • As there is no affected-version list in the supplied data, inventory installed Podman versions across the fleet now so remediation can be applied quickly once a fixed release ships.

3. Long-term hardening.

   • Enforce image provenance: use signed images from trusted registries rather than side-loading tars.
   • Adopt the principle of least privilege for all container tooling users; avoid rootful Podman on shared hosts.
   • Add file-integrity monitoring for user home directories and system config paths to catch unexpected writes.
   • Build detection and alerting (per the rules above) for podman load execution and archive extraction events.
   • Track CISA KEV and EPSS for any change in exploitation status; currently EPSS is 0.00193 (9.2nd percentile), indicating low near-term exploitation likelihood.

References

1. NVD — CVE-2025-11395: https://nvd.nist.gov/vuln/detail/CVE-2025-11395
2. MITRE CWE-277 — Insecure Inherited Permissions: https://cwe.mitre.org/data/definitions/277.html
3. Podman project security advisories and release notes: https://github.com/containers/podman/security/advisories
4. FIRST EPSS — CVE-2025-11395 scoring: https://api.first.org/data/v1/epss?cve=CVE-2025-11395
5. CISA Known Exploited Vulnerabilities Catalog (status check): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No evidence of exploitation in the wild. CISA KEV listing: NO. No public PoC, Nuclei template, or exploit code is tracked. Exploitation likelihood is currently assessed as low based on EPSS (0.00193, 9.2% percentile) and the adjacent attack vector requirement.