5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55686

CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability

Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55686

CVE-2026-55686:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/containers/podman/v5	go	<= 5.7.0	5.7.1
github.com/containers/podman/v4	go	<= 4.9.5
github.com/containers/podman/v3	go	<= 3.4.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handling of symlinks within the WORKDIR path of a container image. The provided patches clearly show that the functions Container.resolveWorkDir and Container.isWorkDirSymlink in libpod/container_internal_common.go were responsible for this insecure handling. The function isWorkDirSymlink was completely removed, indicating it was a key part of the vulnerability. It attempted to manually resolve symlinks, a process which was flawed and allowed for path traversal. The resolveWorkDir function was modified to replace the call to the vulnerable resolvePath and isWorkDirSymlink with a call to securejoin.SecureJoin, a library designed to prevent path traversal attacks. This confirms that the original implementation of resolveWorkDir was vulnerable. An attacker could exploit this by creating a container image with a specially crafted WORKDIR containing symlinks that, when resolved by the vulnerable functions, would point to a location on the host system, allowing the container to create directories outside of its jail.

Vulnerable functions

Container.resolveWorkDir

libpod/container_internal_common.go

The function `resolveWorkDir` was responsible for resolving the container's working directory. It previously used `c.resolvePath` which, in combination with `isWorkDirSymlink`, insecurely handled symlinks in the `WORKDIR` path. This could be exploited by a malicious container image to traverse out of the container's root file system and create directories on the host. The patch replaces this with `securejoin.SecureJoin` to prevent this traversal.

Container.isWorkDirSymlink

libpod/container_internal_common.go

This function was completely removed by the patch. It contained the flawed logic for manually resolving and validating symlinks in the `WORKDIR` path. The function attempted to walk the symlink chain, but did so insecurely, making it the core of the symlink traversal vulnerability. An attacker could craft a `WORKDIR` with symlinks that would be resolved by this function to a path outside of the container's intended file system.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.