Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities found for SingularityPRO by sylabs
CVE-2026-47215 (GCVE-0-2026-47215)
Vulnerability from nvd – Published: 2026-09-15 15:07 – Updated: 2026-09-15 18:02
VLAI
EPSS
VEX
Title
Singularity: Incorrect path matching for 'limit container paths' directive
Summary
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:38 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/sylabs/singularity/security/ad… | x_refsource_CONFIRM |
| https://github.com/sylabs/singularity/pull/4152 | x_refsource_MISC |
| https://github.com/sylabs/singularity/commit/c087… | x_refsource_MISC |
| https://github.com/sylabs/singularity/commit/c1dc… | x_refsource_MISC |
| https://github.com/sylabs/singularity/releases/ta… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| sylabs | singularity |
Affected:
< 4.4.2
|
|
| sylabs | SingularityPRO |
Affected:
< 4.1.14
Affected: >= 4.2.0, < 4.3.9 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:38:21.591354Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:02:51.510Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "singularity",
"vendor": "sylabs",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.2"
}
]
},
{
"product": "SingularityPRO",
"vendor": "sylabs",
"versions": [
{
"status": "affected",
"version": "\u003c 4.1.14"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.3.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator\u0027s configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:07:49.642Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sylabs/singularity/security/advisories/GHSA-wqcr-7rf3-f64m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sylabs/singularity/security/advisories/GHSA-wqcr-7rf3-f64m"
},
{
"name": "https://github.com/sylabs/singularity/pull/4152",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sylabs/singularity/pull/4152"
},
{
"name": "https://github.com/sylabs/singularity/commit/c08791793e843d4c9c1f2fc1d9d12abef747378f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sylabs/singularity/commit/c08791793e843d4c9c1f2fc1d9d12abef747378f"
},
{
"name": "https://github.com/sylabs/singularity/commit/c1dc9470a769e6e534b588a4ed521768ca4fc0d1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sylabs/singularity/commit/c1dc9470a769e6e534b588a4ed521768ca4fc0d1"
},
{
"name": "https://github.com/sylabs/singularity/releases/tag/v4.4.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sylabs/singularity/releases/tag/v4.4.2"
}
],
"source": {
"advisory": "GHSA-wqcr-7rf3-f64m",
"discovery": "UNKNOWN"
},
"title": "Singularity: Incorrect path matching for \u0027limit container paths\u0027 directive"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47215",
"datePublished": "2026-09-15T15:07:49.642Z",
"dateReserved": "2026-05-18T22:25:21.258Z",
"dateUpdated": "2026-09-15T18:02:51.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-33622 (GCVE-0-2021-33622)
Vulnerability from nvd – Published: 2021-06-15 18:59 – Updated: 2024-08-03 23:58
VLAI
EPSS
VEX
Summary
Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function's Return Value.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://medium.com/sylabs | x_refsource_MISC |
| https://support.sylabs.io/support/solutions/artic… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:58:21.532Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://medium.com/sylabs"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.sylabs.io/support/solutions/articles/42000087130-3-5-8-security-release-cve-2021-33622-"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function\u0027s Return Value."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-15T19:00:07.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://medium.com/sylabs"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.sylabs.io/support/solutions/articles/42000087130-3-5-8-security-release-cve-2021-33622-"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33622",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function\u0027s Return Value."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://medium.com/sylabs",
"refsource": "MISC",
"url": "https://medium.com/sylabs"
},
{
"name": "https://support.sylabs.io/support/solutions/articles/42000087130-3-5-8-security-release-cve-2021-33622-",
"refsource": "MISC",
"url": "https://support.sylabs.io/support/solutions/articles/42000087130-3-5-8-security-release-cve-2021-33622-"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33622",
"datePublished": "2021-06-15T18:59:24.000Z",
"dateReserved": "2021-05-28T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:58:21.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-47215 (GCVE-0-2026-47215)
Vulnerability from cvelistv5 – Published: 2026-09-15 15:07 – Updated: 2026-09-15 18:02
VLAI
EPSS
VEX
Title
Singularity: Incorrect path matching for 'limit container paths' directive
Summary
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:38 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/sylabs/singularity/security/ad… | x_refsource_CONFIRM |
| https://github.com/sylabs/singularity/pull/4152 | x_refsource_MISC |
| https://github.com/sylabs/singularity/commit/c087… | x_refsource_MISC |
| https://github.com/sylabs/singularity/commit/c1dc… | x_refsource_MISC |
| https://github.com/sylabs/singularity/releases/ta… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| sylabs | singularity |
Affected:
< 4.4.2
|
|
| sylabs | SingularityPRO |
Affected:
< 4.1.14
Affected: >= 4.2.0, < 4.3.9 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:38:21.591354Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:02:51.510Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "singularity",
"vendor": "sylabs",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.2"
}
]
},
{
"product": "SingularityPRO",
"vendor": "sylabs",
"versions": [
{
"status": "affected",
"version": "\u003c 4.1.14"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.3.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator\u0027s configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:07:49.642Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sylabs/singularity/security/advisories/GHSA-wqcr-7rf3-f64m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sylabs/singularity/security/advisories/GHSA-wqcr-7rf3-f64m"
},
{
"name": "https://github.com/sylabs/singularity/pull/4152",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sylabs/singularity/pull/4152"
},
{
"name": "https://github.com/sylabs/singularity/commit/c08791793e843d4c9c1f2fc1d9d12abef747378f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sylabs/singularity/commit/c08791793e843d4c9c1f2fc1d9d12abef747378f"
},
{
"name": "https://github.com/sylabs/singularity/commit/c1dc9470a769e6e534b588a4ed521768ca4fc0d1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sylabs/singularity/commit/c1dc9470a769e6e534b588a4ed521768ca4fc0d1"
},
{
"name": "https://github.com/sylabs/singularity/releases/tag/v4.4.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sylabs/singularity/releases/tag/v4.4.2"
}
],
"source": {
"advisory": "GHSA-wqcr-7rf3-f64m",
"discovery": "UNKNOWN"
},
"title": "Singularity: Incorrect path matching for \u0027limit container paths\u0027 directive"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47215",
"datePublished": "2026-09-15T15:07:49.642Z",
"dateReserved": "2026-05-18T22:25:21.258Z",
"dateUpdated": "2026-09-15T18:02:51.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-33622 (GCVE-0-2021-33622)
Vulnerability from cvelistv5 – Published: 2021-06-15 18:59 – Updated: 2024-08-03 23:58
VLAI
EPSS
VEX
Summary
Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function's Return Value.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://medium.com/sylabs | x_refsource_MISC |
| https://support.sylabs.io/support/solutions/artic… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:58:21.532Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://medium.com/sylabs"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.sylabs.io/support/solutions/articles/42000087130-3-5-8-security-release-cve-2021-33622-"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function\u0027s Return Value."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-15T19:00:07.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://medium.com/sylabs"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.sylabs.io/support/solutions/articles/42000087130-3-5-8-security-release-cve-2021-33622-"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33622",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function\u0027s Return Value."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://medium.com/sylabs",
"refsource": "MISC",
"url": "https://medium.com/sylabs"
},
{
"name": "https://support.sylabs.io/support/solutions/articles/42000087130-3-5-8-security-release-cve-2021-33622-",
"refsource": "MISC",
"url": "https://support.sylabs.io/support/solutions/articles/42000087130-3-5-8-security-release-cve-2021-33622-"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33622",
"datePublished": "2021-06-15T18:59:24.000Z",
"dateReserved": "2021-05-28T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:58:21.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}