← Vulnerability feed

Vulnerability record · CVE-2025-65105 · published 2 December 2025

CVE-2025-65105: Lfprojects apptainer vulnerability

Lfprojects · Apptainer

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

5.3 CVSS 3.1 Medium EPSS 0.23% · top 86.8% CWE-61 · CWE-61CWE-706 · CWE-706
5.3CVSS 3.1 base score
0.23%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
18 Oct 2026Last modified by NVD

Description

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/apptainer/apptainer/commit/4313b42717e18a4add7dd7503528bc15af905981 Patch
https://github.com/apptainer/apptainer/commit/82f17900a0c31bc769bf9b4612d271c7068d8bf2 Patch
https://github.com/apptainer/apptainer/pull/3226 Issue Tracking
https://github.com/apptainer/apptainer/security/advisories/GHSA-j3rw-fx6g-q46j PatchVendor Advisory
https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm Not Applicable
https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87 Not Applicable

Track CVE-2025-65105 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2023-30549Lfprojects apptainer use after free vulnerabilityApptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.…EPSS 0.37%3.3CVE-2023-38496Lfprojects apptainer improper privilege management vulnerabilityApptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, …EPSS 0.26%7.5CVE-2015-5477ISC BIND TKEY Query Assertion Failure Denial of ServiceISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 mishandle TKEY queries, triggering a REQUIRE assertion failure that terminates the named dae…KEVEPSS 99%analysed8.5CVE-2026-54420LiteSpeed cPanel plugin symlink following on shared hostingThe LiteSpeed cPanel plugin before 2.4.8 (and LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks supplied by a user who has FTP or web shell ac…KEVEPSS 0.81%analysed9.8CVE-2025-58360GeoServer WMS GetMap XXE allows unauthenticated file read and SSRFGeoServer versions 2.26.0 through 2.26.2 and before 2.25.6 accept XML input at the /geoserver/wms GetMap endpoint without sufficiently restricting ex…KEVEPSS 60%analysed9.8CVE-2025-2776SysAid On-Prem unauthenticated XXE in Server URL processingSysAid On-Prem versions up to 23.3.40 process the Server URL without restricting XML external entities, so an unauthenticated attacker can supply cra…KEVEPSS 65%analysed7.5CVE-2025-2775SysAid On-Prem unauthenticated XXE in Checkin processingSysAid On-Prem versions up to 23.3.40 process Checkin XML without restricting external entities, so an unauthenticated attacker can supply a crafted …KEVEPSS 43%analysed7.1CVE-2025-0111PAN-OS authenticated file read via management web interfacePAN-OS contains an authenticated file read vulnerability that lets a user with network access to the management web interface read files on the PAN-O…KEVEPSS 2.0%analysed

Source: NIST National Vulnerability Database (record CVE-2025-65105), CISA KEV, FIRST EPSS (scores of 2026-10-19). This page is refreshed as NVD updates the record.