A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with… (CVE-2025-11395)
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
AI Analysis
Technical Summary
CVE-2025-11395 is a flaw in Podman where passing a specially crafted tar archive to the 'podman load' command enables an attacker to write arbitrary files on the host machine with the privileges of the Podman user. The vulnerability is classified under CWE-277 (Insecure Inherited Permissions). Red Hat has acknowledged the issue but currently does not provide a fix or mitigation that meets their product security standards. The CVSS v3.1 base score is 5.5, reflecting a medium severity with low attack complexity and no user interaction required.
Potential Impact
An attacker able to invoke the 'podman load' command with a crafted tar archive can create or overwrite files on the host system with the same privileges as the user running Podman. This can lead to confidentiality, integrity, and availability impacts at a low level, depending on the privileges of the Podman user. There are no known exploits in the wild at this time.
Mitigation Recommendations
Currently, there is no official fix or mitigation available that meets Red Hat's criteria for deployment and stability. Users should monitor Red Hat advisories for updates. Until a fix is released, restricting access to the 'podman load' command and limiting user privileges may reduce risk.
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with… (CVE-2025-11395)
Description
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-11395 is a flaw in Podman where passing a specially crafted tar archive to the 'podman load' command enables an attacker to write arbitrary files on the host machine with the privileges of the Podman user. The vulnerability is classified under CWE-277 (Insecure Inherited Permissions). Red Hat has acknowledged the issue but currently does not provide a fix or mitigation that meets their product security standards. The CVSS v3.1 base score is 5.5, reflecting a medium severity with low attack complexity and no user interaction required.
Potential Impact
An attacker able to invoke the 'podman load' command with a crafted tar archive can create or overwrite files on the host system with the same privileges as the user running Podman. This can lead to confidentiality, integrity, and availability impacts at a low level, depending on the privileges of the Podman user. There are no known exploits in the wild at this time.
Mitigation Recommendations
Currently, there is no official fix or mitigation available that meets Red Hat's criteria for deployment and stability. Users should monitor Red Hat advisories for updates. Until a fix is released, restricting access to the 'podman load' command and limiting user privileges may reduce risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6jv9-mhj9-v2h4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-11395"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaa07ac55bf5e2cf5e88baf
Added to database: 09/16/2026, 03:06:20 UTC
Last enriched: 09/16/2026, 03:09:39 UTC
Last updated: 09/17/2026, 05:01:24 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.