Medium severity5.9NVD Advisory· Published May 20, 2025· Updated Jun 17, 2026
CVE-2025-47290
CVE-2025-47290
Description
containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/containerd/containerd/v2Go | >= 2.1.0, < 2.1.1 | 2.1.1 |
Affected products
31- cpe:2.3:a:linuxfoundation:containerd:2.1.0:*:*:*:*:*:*:*
- osv-coords29 versionspkg:apk/chainguard/docker-composepkg:apk/chainguard/docker-compose-fipspkg:apk/chainguard/neuvectorpkg:apk/chainguard/neuvector-cis-benchmarkspkg:apk/chainguard/neuvector-controllerpkg:apk/chainguard/neuvector-controller-fipspkg:apk/chainguard/neuvector-enforcerpkg:apk/chainguard/neuvector-enforcer-fipspkg:apk/chainguard/neuvector-fipspkg:apk/chainguard/neuvector-monitorpkg:apk/chainguard/neuvector-nstoolspkg:apk/chainguard/neuvector-scannerpkg:apk/chainguard/neuvector-scanner-monitorpkg:apk/chainguard/neuvector-scanner-taskpkg:apk/chainguard/neuvector-upgraderpkg:apk/chainguard/neuvector-upgrader-fipspkg:apk/wolfi/docker-composepkg:apk/wolfi/neuvectorpkg:apk/wolfi/neuvector-cis-benchmarkspkg:apk/wolfi/neuvector-controllerpkg:apk/wolfi/neuvector-enforcerpkg:apk/wolfi/neuvector-monitorpkg:apk/wolfi/neuvector-nstoolspkg:apk/wolfi/neuvector-scannerpkg:apk/wolfi/neuvector-scanner-monitorpkg:apk/wolfi/neuvector-scanner-taskpkg:golang/github.com/containerd/containerd/v2pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/kind&distro=openSUSE%20Tumbleweed
< 2.36.2-r0+ 28 more
- (no CPE)range: < 2.36.2-r0
- (no CPE)range: < 2.36.1-r1
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r2
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r2
- (no CPE)range: < 5.4.4-r2
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 3.813-r0
- (no CPE)range: < 3.813-r0
- (no CPE)range: < 3.813-r0
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r2
- (no CPE)range: < 2.36.2-r0
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 5.4.4-r1
- (no CPE)range: < 3.813-r0
- (no CPE)range: < 3.813-r0
- (no CPE)range: < 3.813-r0
- (no CPE)range: >= 2.1.0, < 2.1.1
- (no CPE)range: < 0.0.20250523T151856-1.1
- (no CPE)range: < 0.29.0-1.1
- Range: = 2.1.0
Patches
Vulnerability mechanics
References
5- github.com/containerd/containerd/commit/cada13298fba85493badb6fecb6ccf80e49673ccnvdPatchWEB
- github.com/advisories/GHSA-cm76-qm8v-3j95ghsaADVISORY
- github.com/containerd/containerd/security/advisories/GHSA-cm76-qm8v-3j95nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-47290ghsaADVISORY
- github.com/containerd/containerd/releases/tag/v2.1.1nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.