Singluarity: Incorrect path matching for 'limit container paths' directive
### Impact The `limit container paths` directive in `singularity.conf` is intended to allow a system administrator limit the paths from which containers can be run, under setuid mode. Due to incorrect matching of a path string, sibling directories with similar names may incorrectly be allowed. For example, the configuration: ``` limit container paths = /data/safe ``` Will also allow containers in `/data/safe-but-unsafe` to be run. ### Patches This issue is patched in SingularityCE 4.4.2 and SingularityPRO 4.3.9 / 4.1.14 ### Workarounds If you do not use the `limit container paths` functionality, then this issue does not affect your installation. If you do use the `limit container paths` functionality then you must update. Please also review the documented limitations when user namespaces are enabled [1].
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-47215US | — | — | ||
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singul… | ||||
references
External citations — patches, advisories, analysis.
- https://docs.sylabs.io/guides/latest/admin-guide/configfiles.html#limiting-container-executionWEB
- https://github.com/sylabs/singularityPACKAGE
- https://github.com/sylabs/singularity/commit/c08791793e843d4c9c1f2fc1d9d12abef747378fWEB
- https://github.com/sylabs/singularity/releases/tag/v4.4.2WEB
- https://github.com/sylabs/singularity/security/advisories/GHSA-wqcr-7rf3-f64mWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan