CVE-2026-79705 — Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside Buildah by non-root callers

The buildah/copier Go package contains a path-traversal flaw. When used outside Buildah by a non-root caller, a malicious tar archive containing crafted symlinks can escape the intended extraction directory and create files outside the intended destination. Buildah itself is not affected because it uses chroot hardening.