Threats affecting pkg:golang/github.com/containers/buildah/copier

CVE-2026-79705 is a path traversal vulnerability in the buildah/copier Go package used by Red Hat Hardened Images. When used outside of Buildah by a non-root user, a crafted tar archive with malicious symlinks can escape the intended extraction directory and create files elsewhere on the filesystem. Buildah itself is not affected due to chroot hardening. The vulnerability can be exploited when a macOS Podman remote client performs 'podman cp' against a malicious Podman system service server, requiring user interaction and a malicious server. Red Hat advises only performing 'podman cp' operations against trusted servers. A security update addressing this issue is available in Red Hat Hardened Images RPMs.