CVE-2026-47215

Name of the Vulnerable Software and Affected Versions SingularityCE versions prior to 4.4.2 SingularityPRO versions prior to 4.3.9 SingularityPRO versions prior to 4.1.14

Description Incorrect path string matching occurs within the limit container paths directive in singularity.conf, which is designed to restrict the paths from which containers can be executed under setuid mode. This flaw allows sibling directories with similar names to be incorrectly permitted. For instance, a configuration intended to limit paths to /data/safe would also allow containers located in /data/safe-but-unsafe to run.

Recommendations Update SingularityCE to version 4.4.2. Update SingularityPRO to version 4.3.9. Update SingularityPRO to version 4.1.14.