--- id: "CVE-2026-115392" kind: "vulnerability" aliases: ["CVE-2026-115392"] title: "Wasmtime: symlink trailing-slash flaw lets guests escape WASI filesystem sandbox" severity: "high" cvss: 8.8 epss: 0.00242 exploited: false status: "resolved" category: "package" products: [{"name": "wasmtime", "fixed": ["24.0.13", "36.0.14", "46.0.3", "47.0.4"], "affected": "<= 24.0.12, >= 25.0.0 <= 36.0.13, >= 37.0.0 <= 46.0.2, >= 47.0.0 <= 47.0.3", "ecosystem": "crates.io"}, {"name": "wasmtime-wasi", "fixed": ["24.0.13", "36.0.14", "46.0.3", "47.0.4"], "affected": "<= 24.0.12, >= 25.0.0 <= 36.0.13, >= 37.0.0 <= 46.0.2, >= 47.0.0 <= 47.0.3", "ecosystem": "crates.io"}] ecosystems: ["crates.io"] tags: ["package", "rust", "sandbox-escape", "self-hosted", "wasi", "wasmtime", "webassembly"] not_affected_if: ["default-config-unknown", "linux-kernel-5.6-or-later", "no-preopened-dirs", "no-untrusted-guests", "trusted-guests-only", "windows"] published_at: "2026-10-22T19:17:46+00:00" first_seen_at: "2026-10-23T21:57:31+00:00" updated_at: "2026-10-24T07:15:51+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115392", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:39:55+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115392", "first_seen_at": "2026-10-24T07:15:51+00:00"}] --- # Wasmtime: symlink trailing-slash flaw lets guests escape WASI filesystem sandbox Wasmtime's wasmtime-wasi filesystem sandbox relies on cap-std, which mishandles symlinks with a trailing slash. A guest with write access to any preopened directory can read and write any file the host process can reach. A read-only guest can read host files through symlinks already in the directory. Only macOS and Linux kernels older than 5.6 (no openat2) are affected; Linux 5.6 and later use RESOLVE_BENEATH and are not. Wasmtime 48.0.0 and later is not affected by this CVE. A related bug (GHSA-m9f7-9w4p-gv38, rename of trailing-slash symlinks on macOS/FreeBSD) affects 48.x and 49.x until 48.0.6 and 49.0.3 (36.0.18 on the 36 line). No workaround exists. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - crates.io:wasmtime affected <= 24.0.12, >= 25.0.0 <= 36.0.13, >= 37.0.0 <= 46.0.2, >= 47.0.0 <= 47.0.3 fixed 24.0.13, 36.0.14, 46.0.3, 47.0.4 - crates.io:wasmtime-wasi affected <= 24.0.12, >= 25.0.0 <= 36.0.13, >= 37.0.0 <= 46.0.2, >= 47.0.0 <= 47.0.3 fixed 24.0.13, 36.0.14, 46.0.3, 47.0.4 ## How to check Run 'cargo tree -i wasmtime-wasi' or check Cargo.lock for the wasmtime and wasmtime-wasi versions; anything at or below 24.0.12, 25.0.0 to 36.0.13, 37.0.0 to 46.0.2, or 47.0.0 to 47.0.3 is affected. You are only exposed if you run untrusted guests with preopened directories (WasiCtxBuilder::preopened_dir, or --dir in the wasmtime CLI) on macOS or on Linux older than 5.6 ('uname -r'). Check the follow-up advisory too: 48.0.0 to 48.0.5 and 49.0.0 to 49.0.2 are affected on macOS/FreeBSD. ## Fix Upgrade to wasmtime 24.0.13, 36.0.14, 46.0.3 or 47.0.4 (or 48.0.0 and later). To also cover GHSA-m9f7-9w4p-gv38, use 36.0.18, 48.0.6 or 49.0.3. No workaround. Until you upgrade, avoid giving untrusted guests write access to preopened directories on macOS or old kernels. ## Timeline - 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115392 - 2026-10-23T23:39:55+00:00 analyst — Read Bytecode Alliance GHSA-vqjp-4c8c-hfgg, RustSec and the v46.0.3 release. Affected and fixed versions match NVD. No exploitation or public PoC found; I did not search X or HN. A related follow-up, GHSA-m9f7-9w4p-gv38 (rename via trailing-slash symlink, macOS/FreeBSD), affects 48.x and 49.x too, so wasmtime 48.0.0 and later is not clean. - 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115392 ## Documents - [advisory] GHSA-vqjp-4c8c-hfgg: Filesystem sandbox escape when paths or symlinks contain trailing slashes https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg - [advisory] RUSTSEC-2026-0269 https://rustsec.org/advisories/RUSTSEC-2026-0269.html - [fix] wasmtime v46.0.3 https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.3 - [mentions] GHSA-m9f7-9w4p-gv38: sandbox escape when renaming symlinks with trailing slashes (related) https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 ## From the sources Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_