CVE-2025-47290

containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

• CWE-367

• https://github.com/containerd/containerd/commit/cada13298fba85493badb6fecb6ccf80e49673ccPatch
• https://github.com/containerd/containerd/releases/tag/v2.1.1Release Notes
• https://github.com/containerd/containerd/security/advisories/GHSA-cm76-qm8v-3j95Vendor Advisory

Published

May 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-47285Vyper is the Pythonic Programming Language for the Ethereum …2.9
• CVE-2025-47286Combodo iTop is a web based IT service management tool. In v…7.2
• CVE-2025-47287Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2025-47288Discourse Policy plugin gives the ability to confirm users h…3.5
• CVE-2025-47289CE Phoenix is a free, open-source eCommerce platform. A stor…9
• CVE-2025-4729A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0…6.3
• CVE-2025-47291containerd is an open-source container runtime. A bug was fo…7.5
• CVE-2025-47292Cap Collectif is an online decision making platform that int…9.5
• CVE-2025-47293PowSyBl (Power System Blocks) is a framework to build power …2.7
• CVE-2025-47294A integer overflow or wraparound in Fortinet FortiOS version…5.3
• CVE-2025-47295A buffer over-read in Fortinet FortiOS versions 7.4.0 throug…3.7
• CVE-2025-47296Rejected reason: Not used