The Cryostat 4 on RHEL 9 container images have been updated by Red Hat to fix several bugs, including a security vulnerability identified as CVE-2025-59343, which is a symlink validation bypass in the tar-fs component. This vulnerability could potentially allow bypassing security checks related to symbolic links during tar file extraction. The update is delivered as new container images available in the Red Hat Container Registry. Users of Cryostat 4 on RHEL 9 container images should upgrade to these updated images and rebuild any container images that depend on them to incorporate the fixes.

The vulnerability involves a symlink validation bypass in tar-fs, which could allow an attacker to circumvent security controls related to symbolic links in tar archives, potentially leading to unauthorized file access or modification within the container environment. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has provided updated Cryostat 4.0.3 container images on RHEL 9 that include backported patches fixing this vulnerability. Users should upgrade to these updated images available from the Red Hat Container Registry and rebuild all container images that depend on them. This official fix addresses the vulnerability. No additional mitigation steps are indicated by the vendor.