CVE-2026-47215
Received Received - Intake

Path Traversal in SingularityCE and SingularityPRO

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-47215
EUVD
EUVD-2026-78779

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
sylabs singularityce to 4.4.2 (exc)
sylabs singularitypro to 4.1.14 (exc)
singularity singularityce to 4.4.2 (inc)
singularity singularitypro to 4.3.9 (inc)
singularity singularitypro to 4.1.14 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47215 is a vulnerability in SingularityCE and SingularityPRO where the 'limit container paths' directive in singularity.conf uses incorrect path matching. This allows containers in sibling directories to run when only a parent directory is permitted. For example, a container in /data/safe-but-unsafe would be allowed if /data/safe was configured.

Detection Guidance

To detect this vulnerability, check your SingularityCE/SingularityPRO version using 'singularity --version'. If it is below 4.4.2 for SingularityCE or below 4.3.9/4.1.14 for SingularityPRO, the system is vulnerable. Review the 'limit container paths' directive in /etc/singularity/singularity.conf for incorrect path matching.

Impact Analysis

This vulnerability allows unauthorized users to run containers outside the administrator's intended path allowlist. This could lead to execution of malicious containers, potential privilege escalation, or unauthorized access to system resources if the 'limit container paths' feature is enabled.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized container execution outside configured paths. If containers are used to process or store sensitive data, improper path validation may lead to unauthorized access or data leakage. The flaw enables users to run containers from directories not explicitly permitted, which could violate access control requirements in these regulations.

Mitigation Strategies

Upgrade SingularityCE to version 4.4.2 or later, or SingularityPRO to 4.3.9/4.1.14 or later. After upgrading, verify the 'limit container paths' directive in singularity.conf to ensure correct path matching. If using setuid mode, review and adjust the root search path in singularity.conf to exclude $PATH unless explicitly required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47215. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart