CVE-2026-47699 in guest-components
Summary
by MITRE • 08/19/2026
Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make image_rs::stream::unpack::unpack() create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs, try_hardlink_fallback() validates the hardlink source but computes the destination with destination.join(&entry_rel). Rust Path::join replaces the base when entry_rel is an absolute tar entry path, so fs::hard_link(&src_canon, &dst_entry_abs) can write attacker-controlled content to an arbitrary absolute path. In Confidential Containers the workload owner already controls trusted image content, so the issue is a workload-owner escape into the pod virtual machine rather than a crossing of the image trust boundary, but it may enable access to pod virtual machine capabilities and attestation abuse. This issue is fixed in version 0.20.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified within Confidential Containers Guest Components affects versions ranging from 0.16.0 through 0.20.0, specifically targeting the image extraction logic implemented in the Rust-based library known as image-rs. This component is responsible for unpacking OCI container images into guest environments where confidential workloads execute. The core technical flaw resides within the try_hardlink_fallback function located in the stream/unpack.rs module of the source code. While this function correctly validates the source path to ensure it originates from a trusted location, it fails to adequately sanitize or validate the destination path before creating hard links. This asymmetry between input validation for sources and destinations creates a critical security gap that can be exploited by malicious actors constructing specific OCI image layers designed to trigger unintended file system operations.
The mechanism of exploitation relies on how Rust's Path::join method handles absolute paths when combined with relative components. When an attacker crafts a tar entry within the container image layer such that its path is treated as absolute, the join operation does not append it to the intended extraction directory but instead replaces the base destination entirely. Consequently, the fs::hard_link function receives an arbitrary absolute path for the link target rather than a path confined within the expected sandboxed directory structure. This allows the unpacking process to create hard links pointing to files outside the designated container filesystem boundaries, effectively bypassing the isolation mechanisms intended by the confidential computing environment.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The failure to restrict file creation operations to a specific base directory allows an attacker to write data to arbitrary locations on the host filesystem accessible by the guest VM process. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1048: Exfiltration Over Alternative Protocol if used for data theft, or more accurately T1564: Hidden Files and Directories if used to hide malicious artifacts, though its primary impact here is related to privilege escalation via environment manipulation. The vulnerability represents a classic case of insufficient validation on output paths during file system operations, leading to unauthorized access beyond the intended security boundary.
The operational impact of this flaw is significant within the context of confidential computing architectures. Although Confidential Containers typically assume that workload owners control trusted image content, which theoretically limits exposure to untrusted third-party images, the vulnerability still poses a severe risk. It enables a workload-owner escape scenario where code executing inside the pod virtual machine can manipulate files outside its designated scope. This capability allows an attacker with access to the container environment to potentially compromise other workloads running on the same host or interfere with system-level configurations and attestation processes. By writing arbitrary content to sensitive paths, an adversary could tamper with security policies, inject malicious binaries into trusted directories, or disrupt the integrity checks performed by hardware-based attestation mechanisms that verify the state of the confidential environment.
Mitigation strategies primarily involve upgrading to version 0.20.0 or later of Confidential Containers Guest Components, where this issue has been resolved through improved path validation logic. Developers should ensure that all destination paths for file operations are canonicalized and strictly checked against a predefined base directory before any write or link operation is executed. Implementing strict allowlists for permitted directories and utilizing secure temporary files with atomic moves can further reduce the risk of similar vulnerabilities in future implementations. Additionally, adopting defense-in-depth principles by running container extraction processes under minimal privileges limits the potential damage even if such an escape vector were to be exploited again. Regular auditing of image processing libraries against CWE standards helps maintain robust security postures for confidential computing deployments.