CVE-2026-118688

    Dashboard / Vulnerabilities / CVE-2026-118688

    CVE-2026-118688

    Published: 28 Oct 2026Last Modified: 5 Nov 2026

    Summary: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename

    Details: wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to move host directories into its sandbox and read or write them.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118688.json, https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38, https://nvd.nist.gov/vuln/detail/CVE-2026-118688, https://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-sandbox-escape-via-symlink-rename

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c90f2dd4b712703c52e834c08f42e882ee278ba5

    Affected versions

    v48.0.5
    v48.0.4
    v48.0.3
    v48.0.2
    v48.0.1
    v48.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118688 | CVE-DB