CVE-2026-118688: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename
wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to move host directories into its sandbox and read or write them.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects wasmtime-wasi on macOS and FreeBSD hosts when running versions before 36.0.18, versions 37.0.0 through before 48.0.6, or versions 49.0.0 through before 49.0.3. The vulnerable behavior involves rename operations that follow directory symlinks on those host platforms.
What access does an attacker need?
An attacker must be able to run a guest that has sandbox write access and can perform the relevant rename operation. User interaction is also required according to the supplied severity vector.
What could a successful exploit allow?
A guest can rename a relative symlink such as "up/" in a way that moves host directories into its sandbox. This can permit reading from or writing to those host directories.
How can I remediate the issue?
Upgrade to Wasmtime 36.0.18, 48.0.6, or 49.0.3 or later, as applicable to the release line in use.