GHSA-wqcr-7rf3-f64m

Singluarity: Incorrect path matching for 'limit container paths' directive

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-47215

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/sylabs/singularity/v4	< 4.4.2	4.4.2
Go	github.com/sylabs/singularity	<= 3.1.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `limit container paths` directive in `singularity.conf` is intended to allow a system administrator limit the paths from which containers can be run, under setuid mode. Due to incorrect matching of a path string, sibling directories with similar names may incorrectly be allowed. For example, the configuration: ``` limit container paths = /data/safe ``` Will also allow containers in `/data/safe-but-unsafe` to be run. ### Patches This issue is patched in SingularityCE 4.4.2 and SingularityPRO 4.3.9 / 4.1.14 ### Workarounds If you do not use the `limit container paths` functionality, then this issue does not affect your installation. If you do use the `limit container paths` functionality then you must update. Please also review the documented limitations when user namespaces are enabled [1].

References

External links from the advisory. They lead to third-party sites.