Singularity: Incorrect path matching for 'limit container paths' directive
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sylabs | singularity | before 4.4.2 | 4.4.2 | Patch available | CNA |
| sylabs | SingularityPRO | before 4.1.14; 4.2.0 to before 4.3.9 | 4.1.14, 4.3.9 | Patch available | CNA |
| — | github.com/sylabs/singularity/v4 (Go) | before 4.4.2 | 4.4.2 | Patch available | GHSA-wqcr-7rf3-f64m |
| — | github.com/sylabs/singularity (Go) | up to 3.1.1 | — | No fix listed | GHSA-wqcr-7rf3-f64m |
- singularity Vendorsylabs Affected before 4.4.2 Fixed in 4.4.2 Patch available CNA
- SingularityPRO Vendorsylabs Affected before 4.1.14; 4.2.0 to before 4.3.9 Fixed in 4.1.14, 4.3.9 Patch available CNA
- github.com/sylabs/singularity/v4 (Go) Vendor— Affected before 4.4.2 Fixed in 4.4.2 Patch available GHSA-wqcr-7rf3-f64m
- github.com/sylabs/singularity (Go) Vendor— Affected up to 3.1.1 Fixed in — No fix listed GHSA-wqcr-7rf3-f64m
Remediation
- Fix · CNA singularity (sylabs) Fixed in 4.4.2
- Fix · CNA SingularityPRO (sylabs) Fixed in 4.1.14, 4.3.9
- Fix · GHSA-wqcr-7rf3-f64m github.com/sylabs/singularity/v4 (Go) Fixed in 4.4.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47215
- 2026-10-03 Alias added: GHSA-wqcr-7rf3-f64m
References
Other 7
- https://github.com/sylabs/singularity/security/advisories/GHSA-wqcr-7rf3-f64m
- https://github.com/sylabs/singularity/pull/4152
- https://github.com/sylabs/singularity/commit/c08791793e843d4c9c1f2fc1d9d12abef747378f
- https://github.com/sylabs/singularity/commit/c1dc9470a769e6e534b588a4ed521768ca4fc0d1
- https://github.com/sylabs/singularity/releases/tag/v4.4.2
- https://docs.sylabs.io/guides/latest/admin-guide/configfiles.html#limiting-container-execution
- https://github.com/sylabs/singularity
More sylabs vulnerabilities
- TI-2021-12997 Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect… CVSS 3.1CRITICAL 9.8
- TI-2021-12634 Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce. CVSS 3.1CRITICAL 9.8
- TI-2020-12001 Path traversal and files overwrite with unsquashfs CVSS 3.1CRITICAL 9.3
- TI-2022-18614 Digital Signature Hash Algorithms Not Validated in sylabs/sif CVSS 3.1CRITICAL 9.8
- TI-2020-15301 Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used… CVSS 3.1HIGH 8.8
- TI-2019-08462 An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with… CVSS 3.1HIGH 8.8
Sources
- CVE-2026-47215 · CVE Program
- CVE-2026-47215 · NVD
- FIRST EPSS
- GHSA-wqcr-7rf3-f64m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences