CVE-2026-48785: Apptainer has incorrect path matching for 'limit container paths' directive

June 26, 2026

The limit container paths directive in apptainer.conf is intended to allow a system administrator limit the paths from which containers can be run, under setuid mode. Due to incorrect matching of a path string, sibling directories with similar names may incorrectly be allowed.

For example, the configuration:

limit container paths = /data/safe

Will also allow containers in /data/safe-but-unsafe to be run.

References

github.com/advisories/GHSA-cr2j-534f-mf3g
github.com/apptainer/apptainer/security/advisories/GHSA-cr2j-534f-mf3g
nvd.nist.gov/vuln/detail/CVE-2026-48785

Code Behaviors & Features

Detect and mitigate CVE-2026-48785 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →