CVE-2026-47215

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47215
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47215.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47215
Aliases
Downstream
Related
Published
2026-09-15T15:07:49Z
Modified
2026-09-17T03:45:14Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Singularity: Incorrect path matching for 'limit container paths' directive
Details

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47215.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "4.1.14"
                },
                {
                    "introduced": "4.2.0"
                },
                {
                    "fixed": "4.3.9"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/sylabs/singularity

Affected ranges

Type
GIT
Repo
https://github.com/sylabs/singularity
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c08791793e843d4c9c1f2fc1d9d12abef747378f
Fixed
c1dc9470a769e6e534b588a4ed521768ca4fc0d1
Fixed
5baab8f3a42a2c8ef6319a6860775f72b47df7b2
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0
2.*
2.0
2.1
2.1.1
2.1.2
2.2
2.3
2.3.1
2.3.2
2.4
v3.*
v3.0.0
v3.0.0-alpha.1
v3.0.0-beta.1
v3.0.1
v3.1.0
v3.1.0-rc1
v3.1.0-rc2
v3.1.0-rc3
v3.1.0-rc4
v3.10.0-rc.1
v3.11.0-rc.1
v3.2.0-rc1
v3.3.0-rc.1
v3.4.0-rc.1
v3.7.0
v3.7.0-rc.1
v3.7.0-rc.2
v3.8.0-rc.1
v3.9.0-rc.1
v4.*
v4.0.0-rc.1
v4.1.0-rc.1
v4.4.0
v4.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47215.json"