Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting
cve-program · CVE-2025-0750
PublishedA vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.
Read the publisher's advisoryeuvd · EUVD-2025-0171
PublishedA vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.
Read the publisher's advisorynvd · CVE-2025-0750
PublishedA vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.
Read the publisher's advisoryosv · GHSA-hp5j-2585-qx6g
PublishedA vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.
Read the publisher's advisoryosv · GO-2025-3426
PublishedCRI-O Path Traversal vulnerability in github.com/cri-o/cri-o
Read the publisher's advisoryAffected versions, risk and source history
Exploitation and risk
Source statusCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2025-0750
PublishedCri-o: cri-o path traversal in log handling functions allows arbitrary unmounting
A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.
- Source published
- 28 Jan 2025 09:29:30 UTC
- Source modified
- 30 Oct 2026 18:13:58 UTC
- Saved here
- 30 Oct 2026 19:45:26 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
euvd · EUVD-2025-0171
PublishedA vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to n…
A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Jan 28, 2025, 9:29:30 AM
dateUpdated: Oct 30, 2026, 6:13:58 PM
6 related source bulletins · separate from aliases
msrc_CVE-2025-0750: Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting
CVE-2025-0750
RHSA-2025:1122: Red Hat Security Advisory: OpenShift Container Platform 4.17.16 security update
CVE-2025-0750
WID-SEC-W-2025-0343: Red Hat OpenShift: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
CVE-2025-0750
SUSE-SU-2025:0429-1: Security update for govulncheck-vulndb
CVE-2022-47930 · CVE-2024-10846 · CVE-2024-11741 · CVE-2024-13484 · CVE-2024-35177 · CVE-2024-3727 · CVE-2024-45336 · CVE-2024-45339 · CVE-2024-45340 · CVE-2024-45341 · CVE-2024-47770 · CVE-2024-50354 · CVE-2024-9312 · CVE-2024-9313 · CVE-2025-0750 · CVE-2025-22865 · CVE-2025-22866 · CVE-2025-22867 · CVE-2025-23216 · CVE-2025-24366 · CVE-2025-24369 · CVE-2025-24371 · CVE-2025-24376 · CVE-2025-24784 · CVE-2025-24786 · CVE-2025-24787 · CVE-2025-24883 · CVE-2025-24884
RHEA-2024:6126: Red Hat Enhancement Advisory: OpenShift Container Platform 4.18.1 packages and security update
CVE-2024-9341 · CVE-2024-9675 · CVE-2024-9676 · CVE-2024-11218 · CVE-2024-56201 · CVE-2024-56326 · CVE-2025-0750
openSUSE-SU-2025:14728-1: govulncheck-vulndb-0.0.20250130T185858-1.1 on GA media
CVE-2024-10846 · CVE-2024-13484 · CVE-2024-3727 · CVE-2025-0750 · CVE-2025-24369
- Source published
- Jan 28, 2025, 9:29:30 AM (timezone not stated)
- Source modified
- Oct 30, 2026, 6:13:58 PM (timezone not stated)
- Saved here
- 15 Nov 2026 03:33:51 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 3.1 · 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
nvd · CVE-2025-0750
PublishedA vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to n…
A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Deferred
Weakness classifications: CWE-22
Original publisher date fields
published: 2025-01-28T10:15:09.317
lastModified: 2026-10-30T19:17:36.523
- Source published
- 28 Jan 2025 10:15:09 UTC
- Source modified
- 30 Oct 2026 19:17:36 UTC
- Saved here
- 31 Oct 2026 03:47:22 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · [email protected] · Secondary · 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
osv · GHSA-hp5j-2585-qx6g
PublishedCRI-O Path Traversal vulnerability
A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.
- Source published
- 28 Jan 2025 12:31:07 UTC
- Source modified
- 11 Feb 2025 12:30:53 UTC
- Saved here
- 24 Oct 2026 13:19:41 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS_V3 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Publisher rating · MODERATE
osv · GO-2025-3426
PublishedCRI-O Path Traversal vulnerability in github.com/cri-o/cri-o
CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o
- Source published
- 29 Jan 2025 00:01:32 UTC
- Source modified
- 3 Mar 2026 04:57:10 UTC
- Saved here
- 24 Oct 2026 13:19:41 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.