Wasmtime: Filesystem sandbox escape via symlinks with trailing slashes
Summary
Wasmtime's wasmtime-wasi component gives WebAssembly guests access to host files. A flaw in its cap-std dependency lets guests escape the filesystem sandbox when symlinks or paths contain trailing slashes. A guest with write access to a sandboxed directory can read and write any host-accessible file, and a read-only guest can read host files through preexisting symlinks. The issue affects macOS and Linux kernels without openat2, and the CVSS 4.0 base score is 8.8.
Affected
- Wasmtime before 24.0.13
- Wasmtime 25.0.0 before 36.0.14
- Wasmtime 37.0.0 before 46.0.3
- Wasmtime 47.0.0 before 47.0.4
Fixed in
- 24.0.13 (confirmed by vendor release notes)
- 36.0.14 and 46.0.3 (confirmed by vendor release notes)
- 47.0.4 (likely, not yet verified against the vendor advisory)
- 25.x line: no fix identified, status unknown
- Newer related fix: 36.0.18 also addresses GHSA-q554-3cjc-rx7p (symlink renaming with trailing slashes)
Workaround
- No vendor workaround known.
- Until patched, limit WASI filesystem preopens to what is necessary.
- Avoid running untrusted guest code with write access to shared directories.
- Check preopened directories for symlinks that point outside them.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Identify systems and software that embed Wasmtime, for example through Cargo.lock files or vendor products with plugin systems.
- Update to the newest patch release of your line (at least the fixed versions above), not only the minimum version.
- Ask software vendors for their patched version if Wasmtime is embedded in their products.
- Prioritise hosts that run untrusted WASM plugins or multi-tenant code.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vqjp-4c8c-hfgg github.com
- VulnCheck advisory www.vulncheck.com
- Ubuntu security notice CVE-2026-115392 ubuntu.com
- OSV CVE-2026-115392 osv.dev
- OSV RUSTSEC-2026-0269 osv.dev
- Wasmtime release 24.0.13 github.com
- Wasmtime release 46.0.3 github.com
- Wasmtime release 36.0.18 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:54.
Original description (NVD)
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.