Vulnerability · Published Jan 22, 2026 · Assigned by apple
CVE-2026-20613
High 7.8
In plain English
A high-severity path traversal in Container from Apple. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 80.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system using relative pathnames. This issue is addressed in container 0.8.0 and containerization 0.21.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apple | Container | unspecified – before 0.7.1 |
| Apple | Containerization | unspecified – before 0.20.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H