CVE-2026-20613

The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system using relative pathnames. This issue is addressed in container 0.8.0 and containerization 0.21.0.

• CWE-22

• https://github.com/apple/containerization/security/advisories/GHSA-cq3j-qj2h-6rv3Exploit, Vendor Advisory

Published

Jan 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-20608This issue was addressed through improved state management. …5.5
• CVE-2026-20609The issue was addressed with improved memory handling. This …4.4
• CVE-2026-2061A vulnerability was determined in D-Link DIR-823X 250416. Af…7.2
• CVE-2026-20610This issue was addressed with improved handling of symlinks.…7.8
• CVE-2026-20611An out-of-bounds access issue was addressed with improved bo…7.8
• CVE-2026-20612A privacy issue was addressed with improved checks. This iss…5.5
• CVE-2026-20614A path handling issue was addressed with improved validation…7.8
• CVE-2026-20615A path handling issue was addressed with improved validation…7.8
• CVE-2026-20616An out-of-bounds write issue was addressed with improved bou…8.8
• CVE-2026-20617A race condition was addressed with improved state handling.…7
• CVE-2026-20618An issue was addressed with improved handling of temporary f…5.5
• CVE-2026-20619A logging issue was addressed with improved data redaction. …5.5