A path traversal vulnerability in Podman allows an authenticated attacker to overwrite host files, potentially leading to system instability or security configuration bypass.

This vulnerability is caused by improper limitation of a pathname to a restricted directory (CWE-22) during the execution of the kube play command. An authenticated attacker can manipulate symbolic links within a ConfigMap or Secret volume mount to overwrite arbitrary files on the host system, although they cannot control the content written to those files.

Successful exploitation of this flaw poses a significant risk to host integrity. By overwriting critical host files, an attacker could disrupt system services, disable security controls, or degrade system availability, which corresponds to the high CVSS score of 8.1. While the attacker cannot inject arbitrary data, the ability to destroy or truncate essential configuration files provides a potent vector for denial of service or privilege escalation.

Immediate Action: Update Podman to version 5.6.1 or later, or apply the specific security errata provided by Red Hat for your respective distribution.

Proactive Monitoring: Review system logs for unusual kube play command executions and monitor for unexpected changes to sensitive host configuration files or system paths.

Compensating Controls: Restrict access to the Podman command line interface to trusted users only, as the vulnerability requires authenticated access to trigger the malicious kube play command.

Public Exploit Available: Unknown

Given the potential for host file system modification, this vulnerability should be treated with high priority. Organizations using Podman in containerized environments must verify their current version and apply the recommended updates immediately to prevent unauthorized file manipulation on host nodes.