CyberRota Analysis
AI-GeneratedA vulnerability exists in the buildah/copier Go package, allowing non-root users to exploit crafted tar archives with malicious symlinks, potentially creating files outside the designated extraction directory. While Buildah incorporates chroot hardening and remains unaffected, users of the Go package in non-root contexts should prioritize addressing this issue to mitigate risks associated with unauthorized file creation. Organizations utilizing this package should assess their exposure and implement necessary safeguards.
Original NVD Description
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.