ArchiveReader.extractContents() is used by cctl image load and container image load to unpack archives. The function performs no pathname validation before extracting an archive member, allowing a maliciously constructed archive to write a file to any user‑writable location on the system via relative pathnames. This results in an arbitrary file write vulnerability, classified as CWE‑22. The impact is the potential modification or insertion of files on the host filesystem, which can compromise confidentiality, integrity, or availability of the system.

Apple Container and Apple Containerization products are affected. The fix was released in version 0.8.0 of Apple Container and version 0.21.0 of Apple Containerization. All earlier releases remain vulnerable.

The CVSS base score is 7.8, indicating a high level of severity. The EPSS score is reported as less than 1%, suggesting a very low probability of exploitation at the time of this assessment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, where an adversary with access to run cctl image load can supply a crafted archive. No remote exploitation path is detailed in the provided data, but the vulnerability would still allow an attacker to overwrite arbitrary files if the image load process is executed with elevated or write‑capable privileges.