How severe is CVE-2025-47290?

This vulnerability has a severity rating of HIGH with a CVSS score of N/A out of 10.

What type of vulnerability is CVE-2025-47290?

This is classified as CWE-367, which is a common weakness in software security.

CVE-2025-47290 - HIGH Severity | CVSS N/A

Vulnerability Description

containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

Related Vulnerabilities

CVE-2019-5421

CRITICAL

CVSS:9.8(Critical)

Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts...

CWE-3672019

CVE-2019-7249

CRITICAL

CVSS:9.8(Critical)

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system (who didn't have root access) to tamper with...

CWE-3672019

CVE-2023-33154

CRITICAL

CVSS:9.8(Critical)

Windows Partition Management Driver Elevation of Privilege Vulnerability

CWE-3672023

CVE-2024-27114

HIGH

CVSS:9.8(Critical)

A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker can upload a PHP-file that will be avail...

CWE-3672024

CVE-2024-28718

CRITICAL

CVSS:9.8(Critical)

An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py. component.

CWE-3672024

CVE-2024-41779

CRITICAL

CVSS:9.8(Critical)

IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted reques...

CWE-3672024