CVE-2025-47290

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published: May 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-472917.5containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version CVE-2025-472929.5Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, t CVE-2025-472932.7PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-cor CVE-2025-472945.3A integer overflow or wraparound in Fortinet FortiOS versions 7.2.0 through 7.2.7, versions 7.0.0 through 7.0.14 may allow a remote unauthen CVE-2025-472953.7A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 through 7.0.14 may all CVE-2025-47308.8A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is some CVE-2025-47318.8A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of t CVE-2025-473147.8Memory corruption while processing data sent by FE driver.CVE-2025-473157.8Memory corruption while handling repeated memory unmap requests from guest VM.CVE-2025-473167.8Memory corruption due to double free when multiple threads race to set the timestamp store.CVE-2025-473177.8Memory corruption due to global buffer overflow when a test command uses an invalid payload type.CVE-2025-473187.5Transient DOS while parsing the EPTM test control message to get the test pattern.