CVE-2026-79705 Red Hat CVE debrief

Who should care

Defenders responsible for systems using the buildah/copier Go package should assess exposure and verify the package version to prevent potential exploitation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update affected systems to prevent potential exploitation.

Why it matters

CVE-2026-79705 is a flaw in the buildah/copier Go package that allows a crafted tar archive to escape the target extraction directory when used by a non-root caller. Defenders should prioritize verifying the package version and restricting non-root callers to prevent potential exploitation.

• Verification of buildah/copier package version is required to determine exposure
• Non-root callers of the buildah/copier package may be vulnerable to exploitation
• Potential creation of files outside intended destination could lead to unintended system changes

Technical summary

The buildah/copier Go package is vulnerable to a flaw that allows a crafted tar archive to escape the target extraction directory when used by a non-root caller. This could potentially lead to the creation of files outside the intended destination. The vulnerability affects systems using the buildah/copier package, particularly those with non-root callers. Defenders should prioritize verifying the buildah/copier package version and ensuring non-root callers are properly restricted. The CVE record and NVD entry provide details on the flaw, but further verification is needed to determine the full scope of affected systems and potential impact.

Defensive priority

Defenders should prioritize verifying the buildah/copier package version and ensuring non-root callers are properly restricted.

Recommended defensive actions

• Verify the buildah/copier package version and ensure non-root callers are properly restricted.
• Review and update affected systems to prevent potential exploitation.
• Monitor for suspicious activity related to the buildah/copier package.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• whoShouldCare

Evidence notes

The CVE record and NVD entry provide details on the flaw in the buildah/copier Go package. Further verification is needed to determine the full scope of affected systems and potential impact. The buildah/copier package is used in various systems, and its version should be verified to prevent potential exploitation. Non-root callers of the package may be vulnerable to exploitation, and potential creation of files outside the intended destination could lead to unintended system changes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.