CVE-2021-29136: Linuxfoundation Umoci

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.

Affected products

• Linuxfoundation Umoci: before 0.4.7 (fixed in 0.4.7)
• Sylabs Singularity: before 3.7.3 (fixed in 3.7.3)

Published 2021-04-06. Last modified 2026-06-17.