CVE-2025-4953

Podman: build context bind mount

State: Published
Severity: 7.4 High
Published: Sep 16, 2025
Updated: Oct 14, 2026
Reserved: May 19, 2025

Description

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	redhat

Weaknesses

CWE-378 Creation of Temporary File With Insecure Permissions

Affected Products

Product	Versions
podman	all versionsAffectedfrom 50295e5e5d1a4583d26d5c6d5c0608cff498cc8dNot affected
Red Hat Enterprise Linux 8Red Hat	8100020250911075811.afee755d and laterNot affected
Red Hat OpenShift Container Platform 4.12Red Hat	3:4.2.0-15.rhaos4.12.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.12Red Hat	412.86.202601061735-0 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	1:1.29.1-5.rhaos4.13.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	3:2.1.7-5.rhaos4.13.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	1:1.4.0-5.rhaos4.13.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:1.26.5-26.rhaos4.13.giteb3d487.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:1.26.0-7.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:2.2.24-5.rhaos4.13.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:2.15.0-10.rhaos4.13.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:4.13.0-202410181847.p0.g53fd427.assembly.stream.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:4.13.0-202410181847.p0.gd2acdd5.assembly.stream.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:4.13.0-202410181847.p0.g1397e80.assembly.stream.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:4.13.0-202410181847.p0.gd192e90.assembly.stream.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:4.13.0-202410181847.p0.g36754b7.assembly.stream.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	3:4.4.1-15.rhaos4.13.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	4:1.1.14-2.rhaos4.13.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	2:1.11.3-4.rhaos4.13.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	1:1.29.5-1.rhaos4.13.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:5.14.0-284.109.1.el9_2 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:5.14.0-284.109.1.rt14.394.el9_2 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	3:4.4.1-16.rhaos4.13.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	413.92.202511261311-0 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat	414.92.202512031525-0 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat	415.92.202512100122-0 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	4:4.9.4-16.rhaos4.16.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	416.94.202512030118-0 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat	417.94.202511260612-0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	5:5.2.2-2.rhaos4.18.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	418.94.202512022246-0 and laterNot affected
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 9Red Hat

References

RHSA-2024:8690vendor-advisory
RHSA-2025:15904vendor-advisory
RHSA-2025:16724vendor-advisory
RHSA-2025:16729vendor-advisory
RHSA-2025:17669vendor-advisory
RHSA-2025:22265vendor-advisory
RHSA-2025:22275vendor-advisory
RHSA-2025:22695vendor-advisory
RHSA-2025:22724vendor-advisory
RHSA-2025:22732vendor-advisory
RHSA-2025:23113vendor-advisory
RHSA-2025:2703vendor-advisory
RHSA-2026:0316vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-4953vdb-entry
RHBZ#2367235issue-tracking
https://github.com/containers/podman/pull/25173

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.