CVE-2026-79705EPSS p32.7%

CVE-2026-79705CVE-2026-79705

Description

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

Scoring

CVSS 4.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
EPSS0.41% probability of exploitation · percentile 32.7% · 2026-10-05T12:00:23Z
Last modified2026-10-02
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.