Container
CVE-2026-20613
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious archive with path traversal sequences
-
ExploitUser executes cctl image load or container image load
-
ExecutionextractContents() extracts files to arbitrary writable locations
-
ImpactAttacker modifies system files or injects code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local access required. User must manually execute cctl image load or container image load with attacker-controlled archive file. Affects container versions before 0.8.0 and containerization before 0.21.0. |
| Impact | CVSS 7.8 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: None. User interaction: Required. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Path traversal in the ArchiveReader.extractContents() function used by container image load operations allows local attackers to write arbitrary files to any user-writable location on the system by crafting malicious archives with relative pathnames. Public exploit code exists for this vulnerability, and affected users cannot currently patch as fixes are only available in container 0.8.0 and containerization 0.21.0. The vulnerability requires local access and user interaction but carries high severity due to potential for file overwrite and system compromise.
Earlier versions of this analysis (1)
The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. [CVSS 7.8 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-22 (Path Traversal). Affects Container. The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system using relative pathnames. This issue is addressed in container 0.8.0 and containerization 0.21.0.
Know when Container gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system using relative pathnames. This issue is addressed in container 0.8.0 and containerization 0.21.0.
Executive ViewAI
A high-severity vulnerability in container image loading functionality allows attackers to extract files outside intended directories, potentially compromising system integrity and enabling unauthorized access. This affects any organization using affected container tools for image management and requires immediate mitigation to prevent exploitation.
Restrict cctl and container image load access to trusted administrators only; implement network segmentation isolating image loading operations; require manual archive inspection before extraction; disable automated image loading features; enforce signed container images from trusted registries only; monitor process execution for suspicious file extraction patterns; maintain strict file system permissions on container directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
Unbounded memory buffering in Apple's container runtime exposes host systems running versions prior to 1.2.0 to remote d
Path traversal in Apple's open-source container runtime (versions before 1.2.0) enables a malicious builder peer to requ
An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugi
Exploit-DB