{"id":"CVE-2026-115392","kind":"vulnerability","aliases":["CVE-2026-115392"],"related":[],"title":"Wasmtime: symlink trailing-slash flaw lets guests escape WASI filesystem sandbox","description":"Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.","summary":"Wasmtime's wasmtime-wasi filesystem sandbox relies on cap-std, which mishandles symlinks with a trailing slash. A guest with write access to any preopened directory can read and write any file the host process can reach. A read-only guest can read host files through symlinks already in the directory. Only macOS and Linux kernels older than 5.6 (no openat2) are affected; Linux 5.6 and later use RESOLVE_BENEATH and are not. Wasmtime 48.0.0 and later is not affected by this CVE. A related bug (GHSA-m9f7-9w4p-gv38, rename of trailing-slash symlinks on macOS/FreeBSD) affects 48.x and 49.x until 48.0.6 and 49.0.3 (36.0.18 on the 36 line). No workaround exists.","severity":"high","cvss":8.8,"epss":0.00242,"exploited":false,"exploited_at":null,"products":[{"name":"wasmtime","fixed":["24.0.13","36.0.14","46.0.3","47.0.4"],"affected":"<= 24.0.12, >= 25.0.0 <= 36.0.13, >= 37.0.0 <= 46.0.2, >= 47.0.0 <= 47.0.3","ecosystem":"crates.io"},{"name":"wasmtime-wasi","fixed":["24.0.13","36.0.14","46.0.3","47.0.4"],"affected":"<= 24.0.12, >= 25.0.0 <= 36.0.13, >= 37.0.0 <= 46.0.2, >= 47.0.0 <= 47.0.3","ecosystem":"crates.io"}],"ecosystems":["crates.io"],"tags":["package","rust","sandbox-escape","self-hosted","wasi","wasmtime","webassembly"],"not_affected_if":["default-config-unknown","linux-kernel-5.6-or-later","no-preopened-dirs","no-untrusted-guests","trusted-guests-only","windows"],"how_to_check":"Run 'cargo tree -i wasmtime-wasi' or check Cargo.lock for the wasmtime and wasmtime-wasi versions; anything at or below 24.0.12, 25.0.0 to 36.0.13, 37.0.0 to 46.0.2, or 47.0.0 to 47.0.3 is affected. You are only exposed if you run untrusted guests with preopened directories (WasiCtxBuilder::preopened_dir, or --dir in the wasmtime CLI) on macOS or on Linux older than 5.6 ('uname -r'). Check the follow-up advisory too: 48.0.0 to 48.0.5 and 49.0.0 to 49.0.2 are affected on macOS/FreeBSD.","fix":"Upgrade to wasmtime 24.0.13, 36.0.14, 46.0.3 or 47.0.4 (or 48.0.0 and later). To also cover GHSA-m9f7-9w4p-gv38, use 36.0.18, 48.0.6 or 49.0.3. No workaround. Until you upgrade, avoid giving untrusted guests write access to preopened directories on macOS or old kernels.","status":"resolved","published_at":"2026-10-22T19:17:46+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:08+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-10-23T22:32:08Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade wasmtime to 24.0.13, 36.0.14, 46.0.3, or 47.0.4 depending on your release line.","reach":"local","title":"Wasmtime: symlink trailing-slash flaw lets guests escape WASI filesystem sandbox","impact":"high","summary":"Wasmtime's WASI filesystem sandbox, via its cap-std dependency, mishandles symlinks with trailing slashes on macOS and on Linux kernels without openat2. A guest with write access to a sandboxed directory can read and write any host-accessible file, and a read-only guest can read host files through existing symlinks.","category":"package","who_cares":["wasmtime","rust","webassembly","wasi"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Guest code reads and writes arbitrary host files outside the sandbox.","analyst_note":"Confirm which wasmtime-wasi configurations expose preopened directories to guests and whether the cap-std fix is pinned in the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-115392.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-guests","default-config-unknown"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000537,"input_tokens":3031,"output_tokens":468,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm which wasmtime-wasi configurations expose preopened directories to guests and whether the cap-std fix is pinned in the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-115392.","search":"'-115392':15A,18A '-2026':14A,17A '24.0.13':156C '25.0.0':157C '36':149B '36.0.14':159C '36.0.18':146B '37.0.0':160C '46.0.3':162C '47.0.0':164C '47.0.4':166C '48':137B '48.0.0':111B '48.0.6':143B '49':140B '49.0.3':145B '5.6':95B,101B '9w4p':126B 'access':57B,198C,210C 'affect':99B,116B,136B 'allow':167C 'alreadi':84B 'beneath':106B 'bug':122B 'cap':44B,179C 'cap-std':43B,178C 'cve':13A,16A,119B 'depend':181C 'directori':61B,87B,202C 'escap':9A,27B,171C 'exist':153B 'file':67B,81B,211C,220C 'filesystem':11A,39B,169C 'flaw':6A 'ghsa':124B 'ghsa-m9f7-9w4p-gv38':123B 'guest':8A,54B,77B,195C,216C 'gv38':127B 'host':30B,69B,80B,209C,219C 'host-access':208C 'kernel':92B,191C 'lack':192C 'later':103B,113B 'let':7A 'line':150B 'linux':91B,100B,190C 'm9f7':125B 'maco':89B,188C 'macos/freebsd':135B 'may':217C 'mishandl':47B,182C 'older':93B 'openat2':97B,193C 'packag':23B 'preexist':222C 'preopen':60B 'process':70B 'reach':72B 'read':63B,75B,79B,204C,214C,218C 'read-on':74B,213C 'relat':121B 'reli':41B 'renam':128B 'resolv':105B 'rust':24B 'sandbox':12A,26B,40B,170C,201C 'sandbox-escap':25B 'self':29B 'self-host':28B 'slash':5A,52B,132B,186C 'std':45B,180C 'symlink':2A,48B,83B,133B,183C,223C 'trail':4A,51B,131B,185C 'trailing-slash':3A,130B 'use':104B 'via':221C 'wasi':10A,22A,31B,38B,175C 'wasmtim':1A,32B,34B,37B,110B,154C,174C 'wasmtime':19A,21A 'wasmtime-wasi':20A,36B,173C 'webassembl':33B 'workaround':152B 'write':56B,65B,197C,206C 'x':138B,141B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115392","severity":null,"published_at":"2026-10-22T19:17:46+00:00","modified_at":"2026-10-22T19:17:46+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115392:492","url":null,"severity":null,"published_at":"2026-10-23T23:39:55+00:00","modified_at":"2026-10-23T23:39:55+00:00","first_seen_at":"2026-10-23T23:39:55+00:00","fetched_at":"2026-10-23T23:39:55+00:00","note":"Read Bytecode Alliance GHSA-vqjp-4c8c-hfgg, RustSec and the v46.0.3 release. Affected and fixed versions match NVD. No exploitation or public PoC found; I did not search X or HN. A related follow-up, GHSA-m9f7-9w4p-gv38 (rename via trailing-slash symlink, macOS/FreeBSD), affects 48.x and 49.x too, so wasmtime 48.0.0 and later is not clean."},{"source":"epss","external_id":"CVE-2026-115392","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115392","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2099,"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg","title":"GHSA-vqjp-4c8c-hfgg: Filesystem sandbox escape when paths or symlinks contain trailing slashes","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2100,"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38","title":"GHSA-m9f7-9w4p-gv38: sandbox escape when renaming symlinks with trailing slashes (related)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2101,"url":"https://rustsec.org/advisories/RUSTSEC-2026-0269.html","title":"RUSTSEC-2026-0269","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2102,"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.3","title":"wasmtime v46.0.3","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}