CVE-2026-47699

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47699", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T21:18:20.404Z", "datePublished": "2026-08-18T21:24:54.280Z", "dateUpdated": "2026-08-21T19:17:19.410Z"}, "containers": {"cna": {"title": "Confidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallback", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/confidential-containers/guest-components/security/advisories/GHSA-84rc-2q4r-45pc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/confidential-containers/guest-components/security/advisories/GHSA-84rc-2q4r-45pc"}, {"name": "https://github.com/confidential-containers/guest-components/pull/1440", "tags": ["x_refsource_MISC"], "url": "https://github.com/confidential-containers/guest-components/pull/1440"}, {"name": "https://github.com/confidential-containers/guest-components/pull/1457", "tags": ["x_refsource_MISC"], "url": "https://github.com/confidential-containers/guest-components/pull/1457"}, {"name": "https://github.com/confidential-containers/guest-components/commit/14fbb711af0b29bb9cad307969d57b0de9b85d7f", "tags": ["x_refsource_MISC"], "url": "https://github.com/confidential-containers/guest-components/commit/14fbb711af0b29bb9cad307969d57b0de9b85d7f"}, {"name": "https://github.com/confidential-containers/guest-components/commit/7cc1bc458973310296e58aedbb15cb7963297bbe", "tags": ["x_refsource_MISC"], "url": "https://github.com/confidential-containers/guest-components/commit/7cc1bc458973310296e58aedbb15cb7963297bbe"}, {"name": "https://github.com/confidential-containers/guest-components/releases/tag/v0.20.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/confidential-containers/guest-components/releases/tag/v0.20.0"}], "affected": [{"vendor": "confidential-containers", "product": "guest-components", "versions": [{"version": ">= 0.16.0, < 0.20.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T21:24:54.280Z"}, "descriptions": [{"lang": "en", "value": "Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make image_rs::stream::unpack::unpack() create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs, try_hardlink_fallback() validates the hardlink source but computes the destination with destination.join(&entry_rel). Rust Path::join replaces the base when entry_rel is an absolute tar entry path, so fs::hard_link(&src_canon, &dst_entry_abs) can write attacker-controlled content to an arbitrary absolute path. In Confidential Containers the workload owner already controls trusted image content, so the issue is a workload-owner escape into the pod virtual machine rather than a crossing of the image trust boundary, but it may enable access to pod virtual machine capabilities and attestation abuse. This issue is fixed in version 0.20.0."}], "source": {"advisory": "GHSA-84rc-2q4r-45pc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T19:17:03.503833Z", "id": "CVE-2026-47699", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:17:19.410Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:17:03.503833Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:17:11.617Z"}}], "cna": {"title": "Confidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallback", "source": {"advisory": "GHSA-84rc-2q4r-45pc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "confidential-containers", "product": "guest-components", "versions": [{"status": "affected", "version": ">= 0.16.0, < 0.20.0"}]}], "references": [{"url": "https://github.com/confidential-containers/guest-components/security/advisories/GHSA-84rc-2q4r-45pc", "name": "https://github.com/confidential-containers/guest-components/security/advisories/GHSA-84rc-2q4r-45pc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/confidential-containers/guest-components/pull/1440", "name": "https://github.com/confidential-containers/guest-components/pull/1440", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/confidential-containers/guest-components/pull/1457", "name": "https://github.com/confidential-containers/guest-components/pull/1457", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/confidential-containers/guest-components/commit/14fbb711af0b29bb9cad307969d57b0de9b85d7f", "name": "https://github.com/confidential-containers/guest-components/commit/14fbb711af0b29bb9cad307969d57b0de9b85d7f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/confidential-containers/guest-components/commit/7cc1bc458973310296e58aedbb15cb7963297bbe", "name": "https://github.com/confidential-containers/guest-components/commit/7cc1bc458973310296e58aedbb15cb7963297bbe", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/confidential-containers/guest-components/releases/tag/v0.20.0", "name": "https://github.com/confidential-containers/guest-components/releases/tag/v0.20.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make image_rs::stream::unpack::unpack() create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs, try_hardlink_fallback() validates the hardlink source but computes the destination with destination.join(&entry_rel). Rust Path::join replaces the base when entry_rel is an absolute tar entry path, so fs::hard_link(&src_canon, &dst_entry_abs) can write attacker-controlled content to an arbitrary absolute path. In Confidential Containers the workload owner already controls trusted image content, so the issue is a workload-owner escape into the pod virtual machine rather than a crossing of the image trust boundary, but it may enable access to pod virtual machine capabilities and attestation abuse. This issue is fixed in version 0.20.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T21:24:54.280Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47699", "state": "PUBLISHED", "dateUpdated": "2026-08-21T19:17:19.410Z", "dateReserved": "2026-05-19T21:18:20.404Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T21:24:54.280Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "guest-components", "vendor": "confidential-containers", "versions": [{"status": "affected", "version": ">= 0.16.0, < 0.20.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make image_rs::stream::unpack::unpack() create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs, try_hardlink_fallback() validates the hardlink source but computes the destination with destination.join(&entry_rel). Rust Path::join replaces the base when entry_rel is an absolute tar entry path, so fs::hard_link(&src_canon, &dst_entry_abs) can write attacker-controlled content to an arbitrary absolute path. In Confidential Containers the workload owner already controls trusted image content, so the issue is a workload-owner escape into the pod virtual machine rather than a crossing of the image trust boundary, but it may enable access to pod virtual machine capabilities and attestation abuse. This issue is fixed in version 0.20.0."}, {"lang": "es", "value": "Componentes de invitado de Contenedores Confidenciales proporciona herramientas y componentes de invitado para cargas de trabajo de contenedores confidenciales. Desde la versi\u00f3n 0.16.0 hasta la 0.20.0, una capa de imagen OCI manipulada puede hacer que image_rs::stream::unpack::unpack() cree un enlace duro fuera de su directorio de destino. En image-rs/src/stream/unpack.rs, try_hardlink_fallback() valida el origen del enlace duro pero calcula el destino con destination.join(&entry_rel). Path::join de Rust reemplaza la base cuando entry_rel es una ruta de entrada tar absoluta, por lo que fs::hard_link(&src_canon, &dst_entry_abs) puede escribir contenido controlado por el atacante en una ruta absoluta arbitraria. En Contenedores Confidenciales, el propietario de la carga de trabajo ya controla el contenido de la imagen de confianza, por lo que el problema es un escape del propietario de la carga de trabajo hacia la m\u00e1quina virtual del pod en lugar de un cruce del l\u00edmite de confianza de la imagen, pero puede permitir el acceso a las capacidades de la m\u00e1quina virtual del pod y el abuso de la atestaci\u00f3n. Este problema est\u00e1 solucionado en la versi\u00f3n 0.20.0."}], "id": "CVE-2026-47699", "lastModified": "2026-10-22T17:09:59.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47699", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T19:17:03.503833Z", "version": "2.0.3"}}]}, "published": "2026-08-18T22:16:52.127", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/confidential-containers/guest-components/commit/14fbb711af0b29bb9cad307969d57b0de9b85d7f"}, {"source": "security-advisories@github.com", "url": "https://github.com/confidential-containers/guest-components/commit/7cc1bc458973310296e58aedbb15cb7963297bbe"}, {"source": "security-advisories@github.com", "url": "https://github.com/confidential-containers/guest-components/pull/1440"}, {"source": "security-advisories@github.com", "url": "https://github.com/confidential-containers/guest-components/pull/1457"}, {"source": "security-advisories@github.com", "url": "https://github.com/confidential-containers/guest-components/releases/tag/v0.20.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/confidential-containers/guest-components/security/advisories/GHSA-84rc-2q4r-45pc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.16.0,0.20.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "guest-components", "source": "cna", "vendor": "confidential-containers"}, "product": "guest-components", "vendor": "confidential-containers"}], "created": "2026-08-18T23:00:14.598760+00:00", "updated": "2026-08-21T12:31:49.035760+00:00", "vendors": ["confidential-containers", "confidential-containers$PRODUCT$guest-components"]}