Vulnpedia
← Search CVEs

CVE-2026-115392

HIGH 8.8

Published 2026-10-22 · Last modified 2026-10-22

Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.

ELEVATED IMPACT

Severe if exploited (CVSS 8.8), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 15th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.8CVSS 4.0 · HIGH

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ⚠User interaction: Succeeds with passive user activity
  • ✓Complexity: No special conditions — reliably repeatable
  • ⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Bytecodealliance

Products Wasmtime

Weakness (CWE)

  • CWE-61: UNIX Symbolic Link (Symlink) Following

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • wasmtime crates.io

    pkg:cargo/wasmtime

    SEMVER range
    • Introduced version (included): 0.0.0-0
    • Fixed boundary (excluded): 24.0.13
    • Introduced version (included): 25.0.0
    • Fixed boundary (excluded): 36.0.14
    • Introduced version (included): 37.0.0
    • Fixed boundary (excluded): 46.0.3
    • Introduced version (included): 47.0.0
    • Fixed boundary (excluded): 47.0.4
    Additional upstream package constraints
    {
  "ecosystem": {
    "affected_functions": null,
    "affects": {
      "arch": [],
      "functions": [],
      "os": []
    }
  },
  "database": {
    "categories": [],
    "cvss": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
    "informational": null,
    "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0269.json"
  }
}
    RustSec · RUSTSEC-2026-0269 · Updated 2026-10-24T06:25:41Z

All CVSS metrics

  • HIGH 8.8 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
  • HIGH 7.9 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
  • HIGH 8.8 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.9 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS