What is the CVSS score of CVE-2026-20613?

CVE-2026-20613 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Containerization are affected by CVE-2026-20613?

A high-severity vulnerability in container image loading functionality allows attackers to extract files outside intended directories, potentially compromising system integrity and enabling…

Is there a public PoC exploit available for CVE-2026-20613?

Yes, a public proof-of-concept exploit is available for CVE-2026-20613. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-20613?

Within 24 hours: Disable or restrict access to cctl image load and container image load functions until mitigation is in place; audit recent image loads for suspicious activity. Within 7 days: Implement network segmentation to isolate container image loading operations; require image validation through alternative trusted sources. Within 30 days: Monitor vendor communications for patch availability; evaluate alternative container tools with built-in pathname validation; conduct full forensic review of container image history.

Containerization CVE-2026-20613

HIGH

Path Traversal (CWE-22)

2026-01-23 product-security@apple.com

Path Traversal Containerization Container

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 27, 2026 - 20:17 vuln.today

Public exploit code

CVE Published

Jan 23, 2026 - 00:15 nvd

HIGH 7.8

DescriptionCVE.org

The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system using relative pathnames. This issue is addressed in container 0.8.0 and containerization 0.21.0.

AnalysisAI

Path traversal in the ArchiveReader.extractContents() function used by container image load operations allows local attackers to write arbitrary files to any user-writable location on the system by crafting malicious archives with relative pathnames. Public exploit code exists for this vulnerability, and affected users cannot currently patch as fixes are only available in container 0.8.0 and containerization 0.21.0. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious archive with path traversal sequences

Exploit

User executes cctl image load or container image load

Execution

extractContents() extracts files to arbitrary writable locations

Impact

Attacker modifies system files or injects code

Access

Craft malicious archive with path traversal sequences

Exploit

User executes cctl image load or container image load

Execution

extractContents() extracts files to arbitrary writable locations

Impact

Attacker modifies system files or injects code

Vulnerability AssessmentAI

Exploitation	Local access required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.8 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to compromise the affected system.
Remediation	Monitor vendor advisories for a patch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Disable or restrict access to cctl image load and container image load functions until mitigation is in place; audit recent image loads for suspicious activity. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-20613 vulnerability details – vuln.today

Back

Containerization CVE-2026-20613

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code