PT-2025-22285

CVE-2025-47290

Published

2025-05-20

Updated

2025-09-19

Description by

CVSS 4.0

7.6

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U

Name of the Vulnerable Software and Affected Versions containerd version 2.1.0

Description A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd. This issue allows specially crafted container images to arbitrarily modify the host file system while unpacking an image during an image pull.

Recommendations For containerd version 2.1.0, update to version 2.1.1 to resolve the issue. As a temporary workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

Exploitability

Exploit

Fix

Impacts

Researchers

Tõnis Tiigi

Vendors

Affected products

Weakness enumeration

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Related identifiers

CVE-2025-47290