{"id":"CVE-2025-47290","aliases":["GHSA-cm76-qm8v-3j95","GO-2025-3699"],"url":"https://o3.security/vulnerability/CVE-2025-47290","summary":"Containerd vulnerable to host filesystem access during image unpack","details":"### Impact\n\nA time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. \n\n### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.1.1\n\nThe only affected version of containerd is 2.1.0.  Other versions of containerd are not affected.\n\nUsers should update to this version to resolve the issue.\n\n### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images.\n\n### Credits\nThe containerd project would like to thank Tõnis Tiigi for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).\n\n### References\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47290\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n\n* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)","published":"2025-05-20T18:25:51.703Z","modified":"2026-10-28T02:30:27.257711094Z","cvss":null,"epss":{"score":0.00503,"percentile":0.40696,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/containerd/containerd/v2","fixedVersion":"2.1.1"}],"fix":{"url":"https://github.com/containerd/containerd/commit/cada13298fba85493badb6fecb6ccf80e49673cc","label":"containerd/containerd@cada132"},"references":[{"type":"WEB","url":"https://github.com/containerd/containerd/releases/tag/v2.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47290.json"},{"type":"ADVISORY","url":"https://github.com/containerd/containerd/security/advisories/GHSA-cm76-qm8v-3j95"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47290"},{"type":"FIX","url":"https://github.com/containerd/containerd/commit/cada13298fba85493badb6fecb6ccf80e49673cc"},{"type":"PACKAGE","url":"https://github.com/containerd/containerd"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:27.257711094Z"}}