CVE-2026-48785

MEDIUM 4.8

Apptainer: Incorrect path matching for 'limit container paths' directive

CVSS Score

4.8

EPSS Score

0.0%

EPSS Percentile

0th

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local user can consequently run a container from a directory outside the administrator's intended allowlist when Apptainer operates in setuid mode. Installations that do not use setuid mode or do not configure limit container paths are not affected, and unrestricted user namespaces already allow users to run containers of their choice. This issue is fixed in version 1.5.1.

CWE	CWE-22
Vendor	apptainer
Product	apptainer
Published	Sep 15, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for apptainer apptainer

Be the first to know when new medium vulnerabilities affecting apptainer apptainer are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Affected Versions

apptainer / apptainer

< 1.5.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apptainer/apptainer/security/advisories/GHSA-cr2j-534f-mf3g github.com: https://github.com/apptainer/apptainer/pull/3549 github.com: https://github.com/apptainer/apptainer/commit/0ff35257420e0c6cb97dac11d305749c893e5214 github.com: https://github.com/apptainer/apptainer/releases/tag/v1.5.1