CVE-2026-47699

Name of the Vulnerable Software and Affected Versions Confidential Containers Guest Components versions 0.16.0 through 0.19.0

Description A crafted OCI image layer can cause the image rs::stream::unpack::unpack() function to create a hardlink outside its intended destination directory. This occurs because the try hardlink fallback() function in image-rs/src/stream/unpack.rs computes the destination using destination.join(&entry rel). In Rust, Path::join replaces the base path when entry rel is an absolute tar entry path, allowing fs::hard link(&src canon, &dst entry abs) to write attacker-controlled content to an arbitrary absolute path. This can lead to a workload-owner escape into the pod virtual machine, potentially enabling access to pod virtual machine capabilities and attestation abuse.

Recommendations Update to version 0.20.0.