-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/containers/podman/v4 | go | < 4.5.0 | 4.5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper symlink resolution when processing .containerignore/.dockerignore files. The original implementation in pkg/bindings/images/build.go used basic filepath.Join without secure symlink handling, as shown in the removed code from the commit diff. The patched version in pkg/util/utils.go introduced securejoin.SecureJoin to prevent directory traversal, confirming the previous implementation was vulnerable. The CWE-59 classification and advisory description directly align with this insecure file path resolution pattern.