EUVD-2026-63575Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or compromise builder peer credentials
-
DeliveryEstablish peer connection to container build host
-
ExploitCraft file request with path traversal sequences
-
ExecutionHost resolves path outside build context boundary
-
ImpactReceive arbitrary host file contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to control a builder peer that is actively participating in a build session with the target container host - specifically, the peer must have established builder peer credentials or the attacker must have compromised an existing trusted builder peer node (PR:L per CVSS). The vulnerability is network-accessible (AV:N) but is not automatable per SSVC, meaning mass or opportunistic scanning is not a realistic attack model. Impact is strictly limited to file read (C:L); no file modification or service disruption is possible through this flaw. Exploitation is further constrained to environments where Apple's container runtime is deployed with multi-peer build configurations. Single-node or isolated build environments without peer connectivity are not exposed. |
| Impact | The CVSS 3.1 score of 4.3 (medium) is supported by AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, reflecting a network-reachable, low-complexity flaw limited to partial confidentiality loss with no integrity or availability impact. The SSVC framework independently corroborates a measured posture: exploitation is rated none, automatability is no (implying manual targeting effort), and technical impact is partial. These signals collectively indicate this is not a spray-and-pray vulnerability - an attacker must already possess builder peer credentials or have compromised a builder peer node, and must craft specific file requests. No EPSS data was provided in the input. The absence of a CISA KEV listing and any identified proof-of-concept code further reduces immediate escalation priority. This is a real but non-critical confidentiality risk, appropriately prioritized below unauthenticated or high-impact flaws in patch scheduling. |
| Exploit ScenarioDerived | An attacker who controls or has compromised a builder peer node connects to the container build host during an active build session and issues a file request using a crafted name containing path traversal sequences (e.g., referencing a path that resolves to /etc/ssh/ssh_host_rsa_key or application credential files). The host resolves the name without enforcing context boundaries and returns the file contents to the attacker peer. No public proof-of-concept code has been identified at the time of this analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Path traversal in Apple's open-source container runtime (versions before 1.2.0) enables a malicious builder peer to request host files by crafted names that resolve outside the build context, leaking arbitrary host filesystem contents. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation by a low-privileged builder peer with no user interaction required. No active exploitation has been identified (no CISA KEV listing), and SSVC rates exploitation as none and automatability as no, reducing immediate operational urgency.
RemediationAI
Upgrade to Apple container version 1.2.0 or later, which fully addresses this vulnerability per the vendor advisory at https://github.com/apple/container/security/advisories/GHSA-2v2q-4q35-h585. Patch available per vendor advisory; exact upstream commit is referenced in the GitHub security advisory. If an immediate upgrade is not feasible, restrict the trust boundary of builder peers: permit only explicitly authorized, internally controlled nodes to act as builder peers, and deny untrusted or third-party builder peer connections at the network level. Additionally, audit which host filesystem paths are accessible from the build host process and consider running the build host under a restricted service account with read access limited to the intended build context directories only - this limits blast radius if a traversal request succeeds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is Apple's open-source container runtime available at github.com/apple/container, with all versions in the 0.x series prior to 1.2.0 confirmed affected per EUVD-2026-63575. The root cause is CWE-22 (Path Traversal): during build operations, the host resolves file names requested by builder peers without enforcing that the resolved path remains within the designated build context directory. This allows traversal sequences or symlinks to escape the context boundary, causing the host to read and return files from arbitrary filesystem locations. The flaw exists in the builder peer communication protocol - a distributed component that exchanges file content between build participants - rather than in container isolation primitives themselves.
Know when Container gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Builder peer access requires low-privilege credentials over network; impact is read-only file disclosure with no integrity or availability effect.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
2DescriptionCVE.org
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Path traversal in the ArchiveReader.extractContents() function used by container image load operations allows local atta
Unbounded memory buffering in Apple's container runtime exposes host systems running versions prior to 1.2.0 to remote d
An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugi
Exploit-DB