CVE-2020-10696

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Red Hat	buildah	Fixed in buildah-1.14.5

References

https://access.redhat.com/security/cve/cve-2020-10696Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10696Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/containers/buildah/pull/2245Exploit, Third Party Advisory
https://access.redhat.com/security/cve/cve-2020-10696Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10696Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/containers/buildah/pull/2245Exploit, Third Party Advisory

Timeline

Published: Mar 31, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-106974.4A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage CVE-2020-106983.3A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run fr CVE-2020-106997.8A flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system en CVE-2020-10707.8An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system CVE-2020-107005.3A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A m CVE-2020-107016.5A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-on CVE-2020-107025.5A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in CVE-2020-107036.5A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for f CVE-2020-107047.5A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Direc CVE-2020-107057.5A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may ca CVE-2020-107066.6A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This f CVE-2020-107097.1A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provi