TI-2026-16670 Aliases CVE-2026-20613 GHSA-cq3j-qj2h-6rv3

Path traversal in Apple Container

HIGH 69CWE-22Published 2026-01-22 · Updated 2026-01-23

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system using relative pathnames. This issue is addressed in container 0.8.0 and containerization 0.21.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00272 19th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Container (Apple): 0.7.1Containerization (Apple): 0.20.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apple	Container	before 0.7.1	0.7.1	Patch available	CNA
Apple	Containerization	before 0.20.1	0.20.1	Patch available	CNA
—	github.com/apple/containerization (SwiftURL)	before 0.21.0	0.21.0	Patch available	GHSA-cq3j-qj2h-6rv3
—	github.com/apple/container (SwiftURL)	before 0.8.0	0.8.0	Patch available	GHSA-cq3j-qj2h-6rv3

Container VendorApple Affected before 0.7.1 Fixed in 0.7.1 Patch available CNA
Containerization VendorApple Affected before 0.20.1 Fixed in 0.20.1 Patch available CNA
github.com/apple/containerization (SwiftURL) Vendor— Affected before 0.21.0 Fixed in 0.21.0 Patch available GHSA-cq3j-qj2h-6rv3
github.com/apple/container (SwiftURL) Vendor— Affected before 0.8.0 Fixed in 0.8.0 Patch available GHSA-cq3j-qj2h-6rv3

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apple:container::::::swift::*	before 0.8.0	Vulnerable	Apple
cpe:2.3:a:apple:containerization::::::swift::*	before 0.21.0	Vulnerable	Apple

cpe:2.3:a:apple:container:*:*:*:*:*:swift:*:* Versions before 0.8.0 Vulnerable ·Apple
cpe:2.3:a:apple:containerization:*:*:*:*:*:swift:*:* Versions before 0.21.0 Vulnerable ·Apple

Remediation

Fix · CNA Container (Apple) Fixed in 0.7.1
Fix · CNA Containerization (Apple) Fixed in 0.20.1
Fix · GHSA-cq3j-qj2h-6rv3 github.com/apple/containerization (SwiftURL) Fixed in 0.21.0 Advisory →
Fix · GHSA-cq3j-qj2h-6rv3 github.com/apple/container (SwiftURL) Fixed in 0.8.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-20613
2026-10-03 Alias added: GHSA-cq3j-qj2h-6rv3

References

Exploit 1

https://github.com/apple/containerization/security/advisories/GHSA-cq3j-qj2h-6rv3

Other 2

TI-2026-46305 Resource allocation without limits in Apple container CVSS 3.1HIGH 7.5
TI-2026-23094 Insufficiently protected credentials in Apple macOS CVSS 3.1MEDIUM 6.5
TI-2026-46309 Path traversal in Apple container CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences