CVE-2026-115392 Details
Description
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.
A filesystem sandbox escape vulnerability has been identified in Wasmtime versions prior to 24.0.13, 25.0.0 prior to 36.0.14, 37.0.0 prior to 46.0.3, and 47.0.0 prior to 47.0.4. This vulnerability arises in the 'wasmtime-wasi' component due to the 'cap-std' dependency improperly handling symlinks with trailing slashes on macOS and certain Linux kernels lacking the openat2 syscall. As a result, a guest with write access to any sandboxed directory can read and write to any host-accessible file. Additionally, read-only guests may access host files through preexisting symlinks.
Users are advised to upgrade to Wasmtime versions 24.0.13, 36.0.14, 46.0.3, or 47.0.4, all of which include the necessary patch. After version 48.0.0, Wasmtime is not affected by this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-61 | UNIX Symbolic Link (Symlink) Following | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | <= 24.0.12 (semver) >= 25.0.0, < 36.0.14 (semver) >= 37.0.0, < 46.0.3 (semver) >= 47.0.0, < 47.0.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |