CVE-2026-47215mediumCWE-22

CVE-2026-47215: fallo de gravedad media en sylabs singularity

Singularity: Incorrect path matching for 'limit container paths' directive

Publicada el

Seguir esta CVE+ Monitorear singularity+ Monitorear SingularityPRO

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.8epss 0.2%
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Productos afectados
sylabs · singularitysylabs · SingularityPRO
CVEs relacionadas — sylabs singularity

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-32635MEDIUMAction Commands (run/shell/exec) Against Library URIs Ignore Configured Remote EndpointEPSS 1.4%CVE-2025-64750MEDIUMSingluarity ineffectively applies of selinux / apparmor LSM process labelsEPSS 0.2%