CVE-2020-1726

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-552

Affected software

VendorProductVersions
Thepodmanfrom 1.6.0 onwards

References

Timeline

Published
Feb 11, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-17275.4A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validationCVE-2020-17285.4A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing gCVE-2020-17294.4A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially CVE-2020-17305.3A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The serCVE-2020-17319.8A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random adminCVE-2020-17324.2A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption acrossCVE-2020-17335.0A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unpriviCVE-2020-17347.4A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() wiCVE-2020-17354.6A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then chCVE-2020-173528.8Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attaCVE-2020-173539.8scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-pCVE-2020-173548.6LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated b
CVE-2020-1726: Medium severity, CVSS 5.9 | Vulnix