CVE-2026-79705 describes a directory traversal flaw in the buildah/copier Go package. When the package is used outside of the Buildah container tool by a non-root caller, a specially crafted tar archive containing malicious symbolic links can cause files to be extracted outside the intended directory. This can lead to unauthorized file creation or modification outside the target extraction path. Buildah is not vulnerable due to its chroot hardening protections. The vulnerability has a CVSS v3.1 base score of 4.5, indicating medium severity with impact on integrity but no confidentiality or availability impact.

The vulnerability allows an attacker with non-root privileges using the buildah/copier package outside of Buildah to create or overwrite files outside the intended extraction directory by exploiting malicious symlinks in tar archives. This can lead to integrity violations of the filesystem. Buildah itself is not impacted due to chroot hardening. There are no known exploits in the wild at this time.

A security update is available from Red Hat as detailed in advisory RHSA-2026:74861. Users should apply the updated packages to remediate this issue. Since Buildah is not affected due to its chroot hardening, no action is required if only using Buildah. For other uses of the buildah/copier package, update to the fixed versions as provided by the vendor advisory.