EUVD-2026-63575Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Builder peer access requires low-privilege credentials over network; impact is read-only file disclosure with no integrity or availability effect.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
3DescriptionCVE.org
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.
AnalysisAI
Path traversal in Apple's open-source container runtime (versions before 1.2.0) enables a malicious builder peer to request host files by crafted names that resolve outside the build context, leaking arbitrary host filesystem contents. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation by a low-privileged builder peer with no user interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to control a builder peer that is actively participating in a build session with the target container host - specifically, the peer must have established builder peer credentials or the attacker must have compromised an existing trusted builder peer node (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (medium) is supported by AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, reflecting a network-reachable, low-complexity flaw limited to partial confidentiality loss with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apple container version 1.2.0 or later, which fully addresses this vulnerability per the vendor advisory at https://github.com/apple/container/security/advisories/GHSA-2v2q-4q35-h585. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in the ArchiveReader.extractContents() function used by container image load operations allows local atta
Unbounded memory buffering in Apple's container runtime exposes host systems running versions prior to 1.2.0 to remote d
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today