CVE-2025-47290highCWE-367

CVE-2025-47290: high-severity vulnerability in containerd

Containerd vulnerable to host filesystem access during image unpack

Published

Follow this CVE+ Monitor containerd+ Monitor containerd

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.6epss 0.5%
containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U
Affected products
containerd · containerd
Related CVEs — containerd

In the same product, most dangerous first.

CVE-2022-23648HIGHInsecure handling of image volumes in containerd CRI pluginEPSS 27.4%CVE-2020-15257MEDIUMcontainerd-shim API Exposed to Host Network ContainersEPSS 3.1%CVE-2020-15157MEDIUMcontainerd can be coerced into leaking credentials during image pullEPSS 2.3%CVE-2021-21334MEDIUMenvironment variable leakEPSS 1.9%CVE-2021-43816HIGHImproper Preservation of Permissions in containerdEPSS 1.8%CVE-2021-32760MEDIUMArchive package allows chmod of file outside of unpack target directoryEPSS 1.6%