A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00077.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Redhat Subscribe
Enterprise Linux Subscribe
Openshift Subscribe

No data.

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-29612 Podman Creates Temporary File with Insecure Permissions
Github GHSA Github GHSA GHSA-m68q-4hqr-mc6f Podman Creates Temporary File with Insecure Permissions
Fixes

Solution

No solution given by the vendor.

Workaround

Avoid long-running build steps and overly permissive file permissions. Use RUN --mount=type=secret for sensitive data instead of bind mounts.

References
Link Providers
https://access.redhat.com/errata/RHSA-2024:8690 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:15904 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:16724 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:16729 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17669 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:22265 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:22275 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:22695 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:22724 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:22732 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:23113 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:2703 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:0316 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2025-4953 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2367235 cve-icon cve-icon
https://github.com/containers/podman/pull/25173 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-4953 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-4953 cve-icon
History

Thu, 15 Jan 2026 19:15:00 +0900

Type Values Removed Values Added
References

Thu, 08 Jan 2026 12:30:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.15::el9
References

Thu, 11 Dec 2025 20:00:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.14::el9
References

Thu, 11 Dec 2025 14:15:00 +0900

Type Values Removed Values Added
References

Thu, 11 Dec 2025 13:45:00 +0900

Type Values Removed Values Added
References

Sat, 06 Dec 2025 03:45:00 +0900

Type Values Removed Values Added
References

Thu, 04 Dec 2025 00:45:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el9
References

Fri, 28 Nov 2025 22:15:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.13::el8
cpe:/a:redhat:openshift:4.13::el9
References

Fri, 21 Nov 2025 15:30:00 +0900

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:8::appstream
References

Mon, 10 Nov 2025 23:00:00 +0900

Type Values Removed Values Added
References

Thu, 16 Oct 2025 20:15:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el8
cpe:/a:redhat:openshift:4.12::el9
References

Thu, 09 Oct 2025 01:15:00 +0900

Type Values Removed Values Added
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos

Thu, 02 Oct 2025 01:45:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.18::el8
cpe:/a:redhat:openshift:4.18::el9
References

Thu, 02 Oct 2025 00:00:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.16::el8
cpe:/a:redhat:openshift:4.16::el9
References

Wed, 01 Oct 2025 22:45:00 +0900

Type Values Removed Values Added
First Time appeared Redhat rhivos
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos

Wed, 17 Sep 2025 09:15:00 +0900

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 17 Sep 2025 02:15:00 +0900

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 17 Sep 2025 00:00:00 +0900

Type Values Removed Values Added
Description A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.
Title Podman: build context bind mount
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-378
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-01-15T10:02:59.511Z

Reserved: 2025-05-19T11:55:32.522Z

Link: CVE-2025-4953

cve-icon Vulnrichment

Updated: 2025-09-16T16:15:18.848Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-16T15:15:45.313

Modified: 2026-01-15T10:16:05.537

Link: CVE-2025-4953

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-09-16T00:00:00Z

Links: CVE-2025-4953 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses