Confidential Containers Guest Components versions 0.16.0 through 0.19.x contain a path traversal vulnerability (CWE-22) in the image unpacking process. Specifically, the function image_rs::stream::unpack::unpack() uses try_hardlink_fallback() to validate hardlink sources but incorrectly computes the destination path by joining the destination directory with an entry-relative path. When the entry path is absolute, Rust's Path::join replaces the base path, allowing the creation of a hardlink outside the intended directory. This can lead to attacker-controlled content being written to arbitrary absolute paths within the pod virtual machine. Since the workload owner controls the trusted image content, this vulnerability enables a workload-owner escape into the pod VM and may allow access to VM capabilities and attestation abuse. The vulnerability is resolved in version 0.20.0.

An attacker with workload owner privileges can exploit this vulnerability to escape the container image boundary and write files to arbitrary locations within the pod virtual machine. This may lead to unauthorized access to pod VM capabilities and potential attestation abuse. The confidentiality and integrity of the pod VM environment can be partially compromised. There is no indication of availability impact. The vulnerability requires network attack vector with low attack complexity and privileges of a workload owner. User interaction is not required.

This vulnerability is fixed in Confidential Containers Guest Components version 0.20.0. Users should upgrade to version 0.20.0 or later to remediate this issue. No other mitigation or workaround is indicated.