Containerd is an open‑source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores the file container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. The vulnerability arises from CWE‑59 (Absolute Path Traversal) and CWE‑61 (Improper Handling of Links). The fix is included in versions 2.3.2, 2.2.5 and 2.1.9.

containerd versions prior to 2.3.2, 2.2.5, and 2.1.9 are affected. Based on the description, it is inferred that the runtime is widely deployed across Kubernetes distributions, making these versions common in production clusters.

The CVSS score of 8.2 classifies this vulnerability as high severity. The EPSS score is below 1%, indicating a low but nonzero likelihood of exploitation. The vulnerability is not yet listed in CISA KEV. The likely attack path, inferred from the description, involves an attacker supplying a malicious checkpoint image that forces the runtime to follow a symlink when restoring container logs, or invoking kubectl logs against a restored checkpoint. Based on the description, it is inferred that this requires either access to the cluster control plane or the ability to upload a checkpoint image, with the possibility being higher in environments with weak image trust policies.