CVE-2026-115392: Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using an affected Wasmtime version with wasmtime-wasi on macOS, or on Linux kernels that lack openat2, are exposed when a guest can access a sandboxed directory. The impact depends on the guest's filesystem permissions and the presence of relevant symlinks.
What level of guest access is required for exploitation?
A guest with write access to any sandboxed directory can exploit the issue to read and write any host-accessible file. A read-only guest may still be able to read host files if preexisting symlinks are available.
Does this affect all Linux systems?
No. The described condition affects Linux kernels lacking openat2, as well as macOS. The provided information does not identify specific kernel versions or configurations.
Which versions contain fixes?
The fixed releases are Wasmtime 24.0.13, 36.0.14, 46.0.3, and 47.0.4. Affected version ranges are releases before 24.0.13, 25.0.0 through before 36.0.14, 37.0.0 through before 46.0.3, and 47.0.0 through before 47.0.4.