What is the CVSS score of CVE-2025-11395?

CVE-2025-11395 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Podman. If CVE-2025-11395

Q: Which versions of Podman. If are affected by CVE-2025-11395?

Arbitrary host file creation in Podman's `podman load` command lets anyone who can supply a crafted tar archive write files on the host with the privileges of the user running Podman.

EUVD-2025-210915 MEDIUM

Insecure Inherited Permissions (CWE-277)

2026-09-15 secalert@redhat.com

GHSA-6jv9-mhj9-v2h4

Information Disclosure

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 23:30 vuln.today

DescriptionNVD

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

AnalysisAI

Arbitrary host file creation in Podman's podman load command lets anyone who can supply a crafted tar archive write files on the host with the privileges of the user running Podman. The flaw (CWE-277, insecure inherited permissions) affects Podman installations where image archives are loaded from untrusted sources, and is scored a moderate CVSS 5.5 because the write primitive is limited to the invoking user's permissions rather than root. No public exploit code and no CISA KEV listing were identified at time of analysis, though the Red Hat advisory and Bugzilla tracker confirm the issue is acknowledged upstream.