CVE-2023-0778

6.8 mediumEPSS 0.5%

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

Severity

CVSS 3.1

6.8 medium

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-367
Published: 2023-03-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

podman_project:podman
redhat:enterprise_linux

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-qwqv-rqgf-8qh8	Go	github.com/containers/podman/v4	<4.4.2	4.4.2
GO-2023-1681	Go	github.com/containers/podman/v4	<4.4.2	4.4.2

References

https://bugzilla.redhat.com/show_bug.cgi?id=2168256
https://bugzilla.redhat.com/show_bug.cgi?id=2168256

Check your stack JSON