CVE-2026-115392: UNIX Symbolic Link (Symlink) Following in bytecodealliance wasmtime
Description
CVE-2026-115392 is a high-severity vulnerability in the bytecodealliance wasmtime runtime affecting multiple version ranges before specific fixed releases. It allows a filesystem sandbox escape via mishandling of symbolic links with trailing slashes on macOS and Linux kernels lacking openat2 support. This flaw enables a guest with write access to any sandboxed directory to read and write any host-accessible file, and read-only guests to read host files through preexisting symlinks.
CVSS v4.0
Score 8.8high
Affected software
bytecodealliance
wasmtime
pkg:cargo/github/bytecodealliance/wasmtimeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in wasmtime-wasi due to its cap-std dependency improperly handling symbolic links that have trailing slashes on certain operating systems (macOS and Linux kernels without openat2). This mishandling allows sandbox escapes where a guest process can bypass filesystem restrictions. Specifically, guests with write permissions in sandboxed directories can read and write arbitrary host files, while read-only guests can read host files via existing symlinks. The affected versions are wasmtime versions before 24.0.13, versions from 25.0.0 before 36.0.14, versions from 37.0.0 before 46.0.3, and versions from 47.0.0 before 47.0.4.
Potential Impact
This vulnerability enables a guest running inside the wasmtime sandbox to escape the filesystem restrictions, potentially accessing and modifying host files that should be inaccessible. This compromises the integrity and confidentiality of the host system's files, posing a significant security risk especially in multi-tenant or untrusted guest environments.
Mitigation Recommendations
A fix is available in wasmtime versions 24.0.13, 36.0.14, 46.0.3, and 47.0.4 and later. Users should upgrade to these or later versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-22T11:27:18.001Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada64a54d27ba8daa75658b
Added to database: 10/22/2026, 19:31:49 UTC
Last enriched: 10/22/2026, 20:30:16 UTC
Last updated: 10/22/2026, 20:55:30 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.