VYPR
← All advisories
High severityNVD Advisory· Published May 20, 2025· Updated May 20, 2025

Containerd vulnerable to host filesystem access during image unpack

CVE-2025-47290

Description

containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/containerd/containerd/v2Go
>= 2.1.0, < 2.1.12.1.1

Affected products

30

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.