CVE-2026-47215: Singularity Path Traversal Vulnerability

CVE-2026-47215 Overview

CVE-2026-47215 is a path traversal weakness [CWE-22] in SingularityCE and SingularityPRO, open source container platforms maintained by Sylabs. The flaw resides in how the limit container paths directive in singularity.conf matches allowed container paths. The code performs a string prefix comparison instead of a path prefix comparison. A local user running under setuid mode can execute a container from a sibling directory such as /data/safe-but-unsafe when only /data/safe is allowlisted. This bypasses the administrator's configured container path allowlist. Installations that do not use limit container paths are not affected.

Critical Impact
Local users can execute containers from directories outside the administrator-defined allowlist when SingularityCE or SingularityPRO runs in setuid mode with limit container paths configured.

Affected Products

SingularityCE prior to 4.4.2
SingularityPRO prior to 4.3.9
SingularityPRO prior to 4.1.14

Discovery Timeline

2026-09-15 - CVE-2026-47215 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-47215

Vulnerability Analysis

The vulnerability is a path traversal issue [CWE-22] caused by incorrect string handling when validating container image paths against an allowlist. The limit container paths directive in singularity.conf is intended to restrict which filesystem paths a user can invoke a container from when Singularity operates in setuid mode. The check compared the target container path against the configured allowlist entries using raw string prefix matching. Because /data/safe is a valid string prefix of /data/safe-but-unsafe, the sibling directory passes validation even though it is not a subpath of the allowed directory. The scope of impact is limited: the attacker must already have local shell access, must interact with the setuid workflow, and must place or reference a container in a sibling path.

Root Cause

The root cause is the use of a lexical string prefix comparison (via Go's strings package) rather than a filesystem-aware path prefix comparison in pkg/image/image.go. Any allowlisted entry acted as an unanchored substring at the start of the candidate path, so sibling directories sharing a common name prefix were treated as if they were nested beneath the allowed directory.

Attack Vector

A local, authenticated user places or references a container image inside a sibling directory whose name begins with the same characters as an allowlisted path. Invoking Singularity in setuid mode against that path passes the flawed allowlist check, and the container executes despite falling outside the administrator's intended boundary.

// Patch excerpt from pkg/image/image.go
 	"fmt"
 	"os"
 	"path/filepath"
-	"strings"
 	"syscall"

 	"github.com/ccoveille/go-safecast/v2"
// Source: https://github.com/sylabs/singularity/commit/c08791793e843d4c9c1f2fc1d9d12abef747378f
// The fix removes the lexical strings-based comparison and switches to a
// path-aware prefix check using filepath semantics, so /data/safe no longer
// matches /data/safe-but-unsafe.

Detection Methods for CVE-2026-47215

Indicators of Compromise

Execution of singularity in setuid mode against container images stored in directories whose paths share a leading substring with an allowlisted entry but are not true subdirectories.
Presence of container image files (.sif, sandbox directories) in sibling paths adjacent to configured limit container paths entries.
Audit records showing successful container starts from paths not intended by administrators.

Detection Strategies

Inventory all hosts running SingularityCE or SingularityPRO and identify those using the limit container paths directive in singularity.conf.
Compare runtime container invocation paths from process auditing (auditd execve records for the singularity binary) against the configured allowlist using proper path semantics.
Alert on any singularity process whose container image argument resolves to a directory outside the intended allowlist parents.

Monitoring Recommendations

Enable Linux auditd rules on the singularity setuid binary to capture full argument vectors and invoking UID.
Forward singularity execution telemetry to a centralized SIEM or data lake for correlation across shared HPC hosts.
Periodically review filesystem layouts near allowlisted directories for sibling paths that could be used to bypass a string prefix check.

How to Mitigate CVE-2026-47215

Immediate Actions Required

Upgrade SingularityCE to 4.4.2 or later.
Upgrade SingularityPRO to 4.3.9 or 4.1.14 or later, depending on the deployed branch.
Audit singularity.conf for limit container paths entries and confirm no sibling directories exist that share a leading substring with allowed paths.
Restrict write access to filesystems near allowlisted container directories on multi-tenant systems.

Patch Information

The fix is delivered in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14. The upstream commits c087917 and c1dc947 replace the string prefix comparison with a filepath-based prefix check. See GitHub Pull Request #4152, the v4.4.2 release notes, and the GHSA-wqcr-7rf3-f64m advisory for full details.

Workarounds

Disable setuid mode in singularity.conf by setting allow setuid = no where operational requirements permit, forcing the userns/rootless execution path.
Rename allowlisted directories so that no sibling directory can share a leading substring (for example, append a trailing separator or unique suffix in filesystem layout planning).
Remove the limit container paths directive if the allowlist is not required, since unconfigured installations are not affected by this specific bypass.

bash

# Verify installed version and upgrade path
singularity --version

# Example: enforce non-setuid execution as a temporary control
# in /etc/singularity/singularity.conf
# allow setuid = no