A flaw was discovered in the buildah/copier Go package that allows a crafted tar extraction when the command is executed by a non‑root caller outside the Buildah environment. This directory traversal vulnerability can lead to arbitrary file creation or modification, potentially compromising data integrity or exposing sensitive files. Buildah itself is not affected because it employs chroot hardening, but the vulnerability is present whenever the copier is invoked directly by users with ordinary privileges.

Red Hat products are impacted, including Red Hat Ansible Automation Platform 2, Red Hel…

The CVSS score of 4.5 indicates medium severity, while the EPSS score of < 1% indicates a very low probability of exploitation, suggesting that widespread exploitation is not documented at this time. The vulnerability is listed as not in the CISA KEV catalog. An attacker would need access to a non‑root process that can execute the podman cp command with a malicious tar archive; the attack vector is local to the system unless the attacker can supply the archive to the podman service or user. The workaround recommends using podman cp only against trusted servers, but the preferred remediation is to apply vendor patches that address the copier component.