CVE-2026-20613: 
Swift vulnerability analysis and mitigation

CVE-2026-20613 is a path traversal vulnerability in Apple's containerization and container Swift packages that allows a maliciously crafted archive to extract files into arbitrary user-writable locations on the system. The flaw resides in the ArchiveReader.extractContents() function, which performs no pathname validation before extracting archive members. Affected versions include containerization ≤ 0.20.1 and container ≤ 0.7.1 (Swift packages). The advisory was published on January 22, 2026. The CVSS v3.1 base score is 7.8 (High), while the GitHub Advisory Database assigns a CVSS v4 score of 1.9 (Low), reflecting the constrained local attack surface (GitHub Advisory, Apple Containerization Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The vulnerable code in Sources/ContainerizationArchive/Reader.swift (line ~180) constructs the extraction target path by directly appending the archive entry's path to the destination directory URL (directory.appending(path: p)) without sanitizing or validating relative path components such as ../. An attacker crafts a tar archive containing entries with paths like ../../../../../../../tmp/pwned.txt; when a user loads this archive via cctl image load or container image load, the file is written to the traversed location. A working proof-of-concept Python script (make-evil-tar.py) is publicly available in the advisory (GitHub Advisory, Apple Containerization Advisory).

Successful exploitation allows an attacker to write arbitrary files to any location on the filesystem that is writable by the current user, potentially overwriting configuration files, shell initialization scripts, or other user-owned resources. The advisory explicitly notes this is not a privilege escalation — files can only be written to already user-writable locations — limiting the blast radius to the current user's permission scope. However, overwriting files such as ~/.bashrc, ~/.zshrc, SSH authorized keys, or application configuration files could enable persistent code execution or credential theft in the context of the affected user (GitHub Advisory, Apple Containerization Advisory).

A public proof-of-concept script (make-evil-tar.py) is included directly in the GitHub Security Advisory, demonstrating the ease of crafting a malicious archive. Exploitation requires user interaction — the victim must load a malicious archive image using cctl image load or container image load. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.006% (0.000060), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Craft a malicious archive: Use the published PoC script or manually create a tar archive containing an entry with a path-traversal filename (e.g., ../../../../../../../tmp/pwned.txt) and arbitrary file content.

import tarfile, io, time
with tarfile.open('evil.tar', 'w') as tar:
    info = tarfile.TarInfo(name='../../../../../../../../../../../tmp/pwned.txt')
    payload = b'pwned\n'
    info.size = len(payload)
    info.mtime = int(time.time())
    info.mode = 0o644
    tar.addfile(info, io.BytesIO(payload))

2. Deliver the archive: Distribute the malicious evil.tar to the target user via social engineering, a compromised registry, or a supply chain attack, disguising it as a legitimate container image archive.
3. Trigger extraction: Convince the victim to load the archive using cctl images load -i evil.tar (containerization project) or the equivalent container image load command.
4. File written to traversed path: The ArchiveReader.extractContents() function appends the unvalidated path from the archive entry directly to the extraction directory, causing the file to be written to the attacker-specified location (e.g., /tmp/pwned.txt or a more sensitive user-writable path).
5. Achieve objective: Depending on the chosen target path, the attacker can overwrite shell initialization files (~/.bashrc, ~/.zshrc), SSH authorized keys (~/.ssh/authorized_keys), or application configs to achieve persistent code execution or unauthorized access in the user's context (GitHub Advisory, Apple Containerization Advisory).

• File System: Unexpected files appearing in user home directories or other user-writable locations (e.g., /tmp/, ~/.ssh/, ~/.config/) shortly after a cctl image load or container image load operation; modifications to shell initialization files (~/.bashrc, ~/.zshrc, ~/.profile) with unexpected content.
• Logs: System or application logs showing cctl or container processes writing files outside the expected extraction directory (e.g., /var/folders/... or a designated image staging area); file access audit logs (if enabled via auditd or macOS Unified Logging) recording writes to unexpected paths by the cctl or container process.
• Process: Invocation of cctl images load or container image load with externally sourced or untrusted archive files; unexpected child processes or scripts executing from user home directories shortly after image load operations (GitHub Advisory).

Apple has released patched versions addressing this vulnerability: containerization 0.21.0 and container 0.8.0. Users should upgrade to these versions immediately. The fix (commit 3e93416) adds pathname validation to ArchiveReader.extractContents() to prevent path traversal. As a workaround prior to upgrading, users should avoid loading container image archives from untrusted or unverified sources. Projects that depend on the containerization library and use the extractContent() function directly should also audit their usage and upgrade the dependency (GitHub Advisory, Apple Containerization Advisory).

The vulnerability was credited to researcher "LLfam" and published by maintainer "madrob" on January 22, 2026. Brief social media activity was observed on Bluesky shortly after disclosure. Red Hat also tracked the CVE via their security advisory system. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (Apple Containerization Advisory, Red Hat CVE).