The vulnerability CVE-2025-4953 in Podman arises from improper handling of temporary files during container image builds using RUN --mount=type=bind mounts. Data written inside the container during the build phase is not discarded as intended, causing files created within the container to persist in the host's temporary build context directory with insecure permissions. This exposure can allow unauthorized access to sensitive data created during the build process. The issue affects Red Hat OpenShift Container Platform 4.12 and related container tools. Red Hat has released updated packages and container images to remediate this vulnerability, as detailed in their security advisories RHSA-2024:8690 and RHSA-2025:15904. Users are advised to upgrade to these fixed versions promptly.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive files created during container builds, impacting confidentiality and integrity of data. The CVSS score of 7.4 reflects a high severity with network attack vector, high complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability. There are no known exploits in the wild currently. The vulnerability affects container build environments using Podman, particularly in Red Hat OpenShift Container Platform 4.12 and container-tools modules on RHEL 8.

Red Hat has released official security updates addressing CVE-2025-4953. Users of Red Hat OpenShift Container Platform 4.13 and container-tools modules on RHEL 8 should upgrade to the latest available packages and container images as per advisories RHSA-2024:8690 and RHSA-2025:15904. Instructions for upgrading clusters and applying asynchronous errata updates are available on Red Hat's documentation portals. No additional mitigation actions are required beyond applying these official fixes.