CVE-2026-79705

Published: September 20, 2026Last modified: October 7, 2026

Description

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

Severity score breakdown

Parameter	Value
Base score	4.5
Attack Vector	NETWORK
Attack complexity	LOW
Privileges required	HIGH
User interaction	REQUIRED
Scope	UNCHANGED
Confidentiality	NONE
Integrity impact	HIGH
Availability impact	NONE
Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Status

Product	Release	Package	Status
Alpaquita Linux	Stream	buildah	Fixed (1.45.1-r0)
Alpaquita Linux	Stream	podman	Fixed (6.1.3-r0)

References

How to Fix Liberica NIK Not Starting on macOS Catalina and Later

If you use macOS Catalina and later you may encounter the issue that prevents Liberica NIK from starting. To fix it, run the following:

sudo xattr -r -d com.apple.quarantine path/to/graalvm/folder/

If you need more help, check out the FAQ at the bottom of this page or contact us.