CVE-2026-47699

Received Received - Intake

Path Traversal in Confidential Containers Guest Components

Publication date: 2026-08-18

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make image_rs::stream::unpack::unpack() create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs, try_hardlink_fallback() validates the hardlink source but computes the destination with destination.join(&entry_rel). Rust Path::join replaces the base when entry_rel is an absolute tar entry path, so fs::hard_link(&src_canon, &dst_entry_abs) can write attacker-controlled content to an arbitrary absolute path. In Confidential Containers the workload owner already controls trusted image content, so the issue is a workload-owner escape into the pod virtual machine rather than a crossing of the image trust boundary, but it may enable access to pod virtual machine capabilities and attestation abuse. This issue is fixed in version 0.20.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-47699

Affected Vendors & Products

Vendor	Product	Version / Range
confidential_containers	guest_components	From 0.16.0 (inc) to 0.20.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Confidential Containers Guest Components versions 0.16.0 to 0.20.0. A crafted OCI image layer can trick the system into creating a hardlink outside its intended directory. The issue occurs in the unpacking process where a path manipulation flaw allows writing files to arbitrary absolute paths on the system.

Detection Guidance

This vulnerability is specific to Confidential Containers Guest Components versions 0.16.0 to 0.20.0. To detect it, check the installed version of image-rs or Confidential Containers Guest Components using package managers like rpm, dpkg, or cargo. For example, run 'cargo list --version' or 'rpm -qa | grep confidential_containers' or 'dpkg -l | grep confidential_containers'.

Impact Analysis

An attacker with control over image content could escape the container workload and gain access to the pod virtual machine. This may allow them to abuse pod capabilities or manipulate attestation mechanisms, potentially leading to unauthorized access or privilege escalation within the virtual machine environment.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to pod virtual machine capabilities and data within confidential containers. As a workload-owner escape, it may allow attackers to bypass isolation controls, leading to unauthorized data access or modification, which violates confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade Confidential Containers Guest Components to version 0.20.0 or later to address the vulnerability. Review and restrict workload image content to prevent malicious OCI image layers from being deployed.

Hi! I’m here to help you understand CVE-2026-47699. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70