A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
CVE-2024-5154
CVSS base score
8.1 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-22
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected products
kubernetes cri-o
redhat openshift container platform
References
- access.redhat.com
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- access.redhat.com
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- bugzilla.redhat.com Issue Tracking
- github.com Vendor Advisory
- access.redhat.com Vendor Advisory