Podman Patches Symlink Traversal Vulnerability in kube play Command (CVE-2025-9566)

The Podman project has issued a security advisory warning of a high-severity vulnerability in the container management tool’s kube play command, tracked as CVE-2025-9566 (CVSS 8.1). According to the advisory, the flaw could allow malicious containers to overwrite host files when the kube file contains a ConfigMap or Secret volume mount and the volume already contains a symlink to a host file.

The vulnerability arises when kube play is used to start Kubernetes YAML configurations that mount ConfigMaps or Secrets into volumes, with a malicious symlink in the mounted volume enabling subsequent runs to overwrite files on the host. To exploit CVE-2025-9566, Podman kube play must be run with a ConfigMap or Secret volume mount, the command executed more than once on the same volume, and a malicious symlink must already exist in the volume after the first run.

Podman has released a patch in v5.6.1 addressing the symlink traversal issue, with a temporary workaround advised to avoid using kube play with ConfigMap or Secret volume mounts.