CVE-2026-47215: sylabs singularity Path Traversal

Vulnerability summary

CVE-2026-47215 is a medium (CVSS 4.8) Path Traversal vulnerability in sylabs singularity. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.2% of scored vulnerabilities.

Timeline

1. 15-09-2026
   PublishedVulnerability first disclosed.
2. 15-09-2026
   Last modifiedVulnerability information updated.

Description

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.