File and Path Handling

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. .krun_config.json symlink attack creates or overwrites file on the host in crunCVE-2025-24965containers · CVSS 8.5 · 0.6% likely

   CWE-22

2. crun follows rootfs /dev symlink while creating default devicesCVE-2026-47766containers · CVSS 5.1 · 0.2% likely

   CWE-61

3. Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archiveCVE-2026-44517containers · CVSS 6.3 · 0.2% likely

   CWE-22

4. Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfsCVE-2026-88264containers · CVSS 5.6 · 0.1% likely

   CWE-59

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.