A crafted OCI image layer can cause the unpack routine to create a hardlink that points to an absolute path outside the intended extraction directory. The Path::join logic in image-rs incorrectly treats an absolute tar entry as a base path, allowing this hardlink to write attacker‑controlled data to an arbitrary absolute file on the pod virtual machine. The vulnerability enables a workload owner who already controls image content to escape the image boundary and write files anywhere inside the pod VM, potentially abusing VM capabilities and compromising attestation mechanisms. The primary effect is an arbitrary file write that could lead to privilege escalation or tampering with the virtual machine’s state.

The vulnerability affects the Confidential Containers Guest Components product, specifically the image‑rs module. All releases from version 0.16.0 up to, but not including, 0.20.0 are vulnerable; version 0.20.0 and later contain the fix.

The CVSS score of 6.4 indicates a medium severity. The EPSS score is not provided, and the CVE is not listed in CISA KEV, suggesting no known widespread exploitation yet. The attack vector requires an attacker to supply a malicious OCI image layer, which a workload owner can create. Therefore the threat primarily exists to malicious insiders who control image content, enabling them to write files outside the intended extraction context and potentially gain broader access to the pod virtual machine. While the vulnerability does not affect image trust cross‑boundary, it still permits significant compromise of the VM environment if left unpatched.