Apptainer up to 1.4.4 symlink

Summaryinfo

A vulnerability was found in Apptainer up to 1.4.4. It has been declared as critical. The impacted element is an unknown function. Such manipulation leads to symlink. This vulnerability is listed as CVE-2025-65105. The attack must be carried out locally. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apptainer up to 1.4.4. It has been rated as critical. Affected by this issue is some unknown processing. The manipulation with an unknown input leads to a symlink vulnerability. Using CWE to declare the problem leads to CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-65105 since 11/17/2025. The exploitation is known to be difficult. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 278585 (Fedora 42 : apptainer (2025-ff963b3775)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.4.5 eliminates this vulnerability. Applying the patch 4313b42717e18a4add7dd7503528bc15af905981 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (278585). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Apptainer

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4

License

• open-source

Website

• Product: https://github.com/apptainer/apptainer/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion