Live › vulnerability › CVE-2026-115392
Go to dashboardWasmtime's wasmtime-wasi filesystem sandbox relies on cap-std, which mishandles symlinks with a trailing slash. A guest with write access to any preopened directory can read and write any file the host process can reach. A read-only guest can read host files through symlinks already in the directory. Only macOS and Linux kernels older than 5.6 (no openat2) are affected; Linux 5.6 and later use RESOLVE_BENEATH and are not. Wasmtime 48.0.0 and later is not affected by this CVE. A related bug (GHSA-m9f7-9w4p-gv38, rename of trailing-slash symlinks on macOS/FreeBSD) affects 48.x and 49.x until 48.0.6 and 49.0.3 (36.0.18 on the 36 line). No workaround exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| wasmtime | crates.io | <= 24.0.12, >= 25.0.0 <= 36.0.13, >= 37.0.0 <= 46.0.2, >= 47.0.0 <= 47.0.3 | 24.0.13, 36.0.14, 46.0.3, 47.0.4 |
| wasmtime-wasi | crates.io | <= 24.0.12, >= 25.0.0 <= 36.0.13, >= 37.0.0 <= 46.0.2, >= 47.0.0 <= 47.0.3 | 24.0.13, 36.0.14, 46.0.3, 47.0.4 |
cargo tree -i wasmtime-wasi or check Cargo.lock for the wasmtime and wasmtime-wasi versions; anything at or below 24.0.12, 25.0.0 to 36.0.13, 37.0.0 to 46.0.2, or 47.0.0 to 47.0.3 is affecteduname -r)48.0.0 to 48.0.5 and 49.0.0 to 49.0.2 are affected on macOS/FreeBSD24.0.13, 36.0.14, 46.0.3 or 47.0.4 (or 48.0.0 and later)36.0.18, 48.0.6 or 49.0.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.
This page as .md · .json · in your agent: get_signal("CVE-2026-115392")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.