CVE-2025-47290

HIGH EPSS 33.2%
Published May 20, 20251y ago · Modified Jun 17, 20262w ago
7.6 CVSS 4.0
High
Find Similar
Published May 20, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

CVSS Details

Base Score
7.6
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
33.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-367

Affected Products 1

VendorProductVersionRange
linuxfoundationcontainerd2.1.0any

References 3

  • github.com https://github.com/containerd/containerd/commit/cada13298fba85493badb6fecb6ccf80e49673cc
    Patch
  • github.com https://github.com/containerd/containerd/releases/tag/v2.1.1
    Release Notes
  • github.com https://github.com/containerd/containerd/security/advisories/GHSA-cm76-qm8v-3j95
    Vendor Advisory

Remediation

  • github.com https://github.com/containerd/containerd/commit/cada13298fba85493badb6fecb6ccf80e49673cc
    Patch