---
id: CVE-2026-48785
title: Apptainer is an open source container platform
summary: >-
  Apptainer is an open source container platform. Prior to version 1.5.1,
  Image.AuthorizedPath applies plain string-prefix matching to the limit
  container paths directive in apptainer.conf, so an allowed path such as
  /data/safe also author…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L'
cwe:
  - CWE-22
vendor: apptainer
product: apptainer
affected:
  - apptainer < 1.5.1
patched:
  - github.com/apptainer/apptainer 1.5.1
published: '2026-09-15'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T14:10:13.927'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48785'
references:
  - url: >-
      https://github.com/apptainer/apptainer/commit/0ff35257420e0c6cb97dac11d305749c893e5214
    label: security-advisories@github.com
  - url: 'https://github.com/apptainer/apptainer/pull/3549'
    label: security-advisories@github.com
  - url: 'https://github.com/apptainer/apptainer/releases/tag/v1.5.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/apptainer/apptainer/security/advisories/GHSA-cr2j-534f-mf3g
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-cr2j-534f-mf3g'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
epss: 0.0015
epssPercentile: 0.03495
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T17:38:03.190026Z'
ingestedAt: '2026-06-29T13:24:35.279Z'
---

## Overview

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local user can consequently run a container from a directory outside the administrator's intended allowlist when Apptainer operates in setuid mode. Installations that do not use setuid mode or do not configure limit container paths are not affected, and unrestricted user namespaces already allow users to run containers of their choice. This issue is fixed in version 1.5.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-48785)

Affected packages:

- `github.com/apptainer/apptainer < 1.5.1`

Patched in:

- `github.com/apptainer/apptainer 1.5.1`

Source: https://github.com/advisories/GHSA-cr2j-534f-mf3g