CVE-2026-79705: Buildah Copier Path Traversal Vulnerability

CVE-2026-79705 Overview

CVE-2026-79705 is a path traversal flaw in the buildah/copier Go package. A crafted tar archive containing malicious symlinks can escape the target extraction directory when the package is used outside of Buildah by a non-root caller. The attacker can create files outside the intended destination directory, enabling file write attacks against arbitrary filesystem locations.

Buildah itself is not affected. Buildah invokes copier inside a chroot, which contains the symlink resolution and prevents escape. Downstream Go projects that import copier as a library without equivalent hardening inherit the vulnerability.

Critical Impact
A non-root process extracting attacker-supplied tar archives with buildah/copier can write files outside the extraction directory, leading to integrity loss and potential code execution via overwritten configuration or script files.

Affected Products

buildah/copier Go package when consumed by third-party callers
Non-root Go applications using copier for tar extraction
Downstream tooling that vendors the copier library outside of Buildah

Discovery Timeline

2026-09-15 - CVE-2026-79705 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-79705

Vulnerability Analysis

The flaw is a symlink-based directory traversal issue tracked under CWE-22. During tar extraction, copier follows symbolic links present inside the archive when resolving file paths. If an archive first creates a symlink pointing outside the destination directory, subsequent entries that reference that symlink cause writes to land at the symlink target rather than inside the extraction root.

Buildah avoids this outcome by running copier operations inside a chroot jail. Symlink targets resolve relative to the chroot, so a link pointing to /etc resolves harmlessly. Third-party consumers of the copier package do not automatically inherit that chroot boundary and are exposed when processing untrusted archives.

Exploitation requires the caller to hold high privileges within its own process context and requires user interaction to trigger extraction of the malicious archive. Confidentiality is not directly impacted, but integrity loss is high because arbitrary files can be created or overwritten within the caller's permission scope.

Root Cause

The root cause is unsafe resolution of symbolic link entries inside untrusted tar archives. The extraction routine does not verify that the fully resolved destination path remains within the target directory before performing file operations, so symlinks planted earlier in the archive redirect later writes outside the extraction root.

Attack Vector

An attacker crafts a tar archive that contains a symlink pointing to a location outside the extraction directory, followed by a regular file entry whose path traverses that symlink. When a non-root Go program using buildah/copier extracts the archive, the write follows the symlink and lands at the attacker-chosen target. The attacker must convince a user or automated pipeline to process the crafted archive.

Refer to the Red Hat CVE-2026-79705 Advisory and Red Hat Bug Report #2523419 for upstream technical details.

Detection Methods for CVE-2026-79705

Indicators of Compromise

Files appearing outside expected extraction directories immediately after a container build or archive import operation.
Tar archives containing symlink entries whose targets resolve outside the archive root, such as links pointing to ../../etc/ or absolute paths.
Unexpected modifications to configuration files, shell profiles, or cron directories owned by the user running a Go-based archive processor.

Detection Strategies

Inspect tar archives before extraction with tar -tvf and flag entries whose link targets contain .. sequences or absolute paths.
Monitor filesystem writes performed by processes linked against the copier package and alert on writes outside the declared working directory.
Compare pre- and post-extraction filesystem state in build pipelines to detect out-of-tree file creation.

Monitoring Recommendations

Enable Linux audit rules on directories commonly targeted by traversal attacks, including /etc, ~/.ssh, and CI runner home directories.
Log the invoking user, working directory, and archive source for every extraction call in build and packaging workflows.
Track dependency manifests (go.mod, go.sum) for use of github.com/containers/buildah/copier and correlate with archive processing activity.

How to Mitigate CVE-2026-79705

Immediate Actions Required

Update any Go project that vendors or imports buildah/copier to a patched release once the upstream fix is available.
Restrict archive extraction operations to trusted sources until the dependency is upgraded.
Run extraction routines under a chroot, container, or user namespace that constrains filesystem access to the intended destination.

Patch Information

Consult the Red Hat CVE-2026-79705 Advisory for the current fix status and package versions. Buildah itself does not require patching because its chroot hardening prevents exploitation.

Workarounds

Wrap copier calls in a chroot or dedicated mount namespace to mirror Buildah's containment model.
Pre-validate tar archives and reject any entry whose symlink target is absolute or resolves outside the destination directory.
Extract untrusted archives as an unprivileged user in an isolated directory, then move validated files into place.

bash

# Reject tar archives containing unsafe symlinks before extraction
tar -tvf untrusted.tar | awk '$1 ~ /^l/ {print $NF}' | \
  grep -E '(^/|\.\./)' && echo "Unsafe symlink detected - refusing to extract"