CVE-2026-79705

Name of the Vulnerable Software and Affected Versions buildah/copier Go package (affected versions not specified)

Description A flaw exists in the buildah/copier Go package. When utilized by a non-root caller outside of the Buildah environment, a specially crafted tar archive containing malicious symlinks can bypass the target extraction directory. This allows the creation of files outside the intended destination, leading to a directory traversal. Buildah is not affected due to its use of chroot hardening, a mechanism that isolates the process by changing its root directory to a specific location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.