Path Traversal Vulnerability in Apptainer Container Platform

CVE-2026-48785

What is CVE-2026-48785?

A vulnerability in the Apptainer container platform allows local users to bypass restricted container paths due to improper string-prefix matching in the configuration file. Specifically, the 'Image.AuthorizedPath' directive permits unintended access to sibling directories, such as running a container from '/data/safe-but-unsafe' even when only '/data/safe' is authorized. This occurs when Apptainer operates in setuid mode, allowing users to execute containers outside the expected allowable path. This issue is addressed in version 1.5.1, which enforces stricter checks on authorized paths to enhance overall security.

References