CVE-2026-47215: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-47215 is a path matching vulnerability in SingularityCE and SingularityPRO affecting the limit container paths directive in singularity.conf. When configured to restrict container execution to specific directories under setuid mode, incorrect string matching logic allows sibling directories with similar names to bypass the restriction — for example, a policy allowing /data/safe would also permit containers in /data/safe-but-unsafe. The vulnerability was published on June 4, 2026, and affects SingularityCE versions prior to 4.4.2 and SingularityPRO versions prior to 4.3.9 / 4.1.14, as well as all versions of the github.com/sylabs/singularity Go module ≤ 3.1.1. It carries a CVSS v3.1 base score of 4.8 (Moderate) (GitHub Advisory, Sylabs Advisory).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). The limit container paths directive performs a simple string prefix match rather than a proper path boundary-aware comparison, meaning a configured allowed path such as /data/safe will also match any path that begins with that string, including /data/safe-but-unsafe. Exploitation requires local access with low privileges and some user interaction, and is only relevant when the limit container paths feature is actively configured in singularity.conf under setuid mode. The fix was introduced in commit c087917 of the sylabs/singularity repository (GitHub Advisory, Sylabs Advisory).

Successful exploitation allows a local user to run containers from directories that a system administrator intended to block, effectively bypassing the path-based access control policy enforced by singularity.conf. This could lead to limited confidentiality, integrity, and availability impacts within the scope of the affected system, as unauthorized containers may access or modify data or consume resources. The vulnerability does not enable privilege escalation beyond what the container runtime already permits, and its scope is unchanged, limiting the blast radius to the local system (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-47215. The EPSS score is approximately 0.01% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to local, low-privileged users on systems where the limit container paths directive is actively configured (GitHub Advisory).

1. Identify target configuration: Confirm that the target system runs SingularityCE < 4.4.2 or SingularityPRO < 4.3.9 / 4.1.14 in setuid mode, and that limit container paths is configured in /etc/singularity/singularity.conf (e.g., limit container paths = /data/safe).
2. Create or access a sibling directory: As a low-privileged local user, create or identify a directory whose name begins with the allowed path string but extends beyond it (e.g., /data/safe-but-unsafe).
3. Place a container image in the sibling directory: Copy or build a Singularity Image Format (SIF) container image into the unauthorized sibling directory (e.g., /data/safe-but-unsafe/malicious.sif).
4. Execute the container: Run the container using the Singularity CLI: singularity run /data/safe-but-unsafe/malicious.sif. Due to the flawed prefix matching, the path check passes and the container executes despite being outside the intended allowed path.
5. Achieve objective: The container runs with whatever capabilities the setuid Singularity runtime grants, potentially accessing data or executing workloads the administrator intended to restrict (GitHub Advisory, Sylabs Advisory).

• Logs: Singularity audit or system logs showing container execution from directories not explicitly listed in limit container paths but sharing a name prefix with an allowed path (e.g., /data/safe-but-unsafe/ when only /data/safe is configured).
• File System: Presence of unexpected SIF container images in sibling directories adjacent to administrator-approved container paths.
• Process: Singularity processes spawned with image paths that do not exactly match any entry in the limit container paths configuration but share a common prefix with a listed path.

Administrators should upgrade to SingularityCE 4.4.2 or SingularityPRO 4.3.9 / 4.1.14, which contain the corrected path matching logic. If upgrading is not immediately possible and the limit container paths directive is not in use, no action is required as the vulnerability does not affect installations without this feature enabled. Administrators using limit container paths who cannot upgrade immediately should audit their directory structures to ensure no sibling directories with similar name prefixes exist and contain untrusted container images. Additionally, the documented limitations when user namespaces are enabled should be reviewed (Sylabs Advisory, Singularity Docs).

Coverage of CVE-2026-47215 has been limited to technical security feeds and Linux distribution update trackers, including a mention in a Fedora update roundup and a German Linux security news site. No notable researcher commentary or significant social media discussion has been identified beyond routine vulnerability disclosure channels (GitHub Advisory).