CVE-2026-47215
Singularity: Incorrect path matching for 'limit container paths' directive
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium4.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L |
| NVDNVD · Awaiting Analysis | 3.1 | Medium4.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L |
- EPSS (exploitation in 30 days)
- 0.15% · top 95% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.
Weakness
Affected products
- affected < 4.4.2
- affected < 4.1.14
- affected >= 4.2.0, < 4.3.9
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/sylabs/singularityGHSA-wqcr-7rf3-f64m (opens in a new tab)
- Gogithub.com/sylabs/singularity/v4GHSA-wqcr-7rf3-f64m (opens in a new tab)
References (5)
- https://github.com/sylabs/singularity/security/advisories/GHSA-wqcr-7rf3-f64m (opens in a new tab)x_refsource_CONFIRM
- https://github.com/sylabs/singularity/pull/4152 (opens in a new tab)x_refsource_MISC
- https://github.com/sylabs/singularity/commit/c08791793e843d4c9c1f2fc1d9d12abef747378f (opens in a new tab)x_refsource_MISC
- https://github.com/sylabs/singularity/commit/c1dc9470a769e6e534b588a4ed521768ca4fc0d1 (opens in a new tab)x_refsource_MISC
- https://github.com/sylabs/singularity/releases/tag/v4.4.2 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-wqcr-7rf3-f64m (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-47215)Record last updated .