CVE-2026-115392

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-115392
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115392.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-115392
Aliases
Downstream
Published
2026-10-22T19:13:58Z
Modified
2026-10-30T02:30:44Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L CVSS Calculator
Summary
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes
Details

Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-61"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115392.json"
}
References

Affected packages

Git / github.com/bytecodealliance/wasmtime

Affected ranges

Type
GIT
Repo
https://github.com/bytecodealliance/wasmtime
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6ab9d98dbe8cbda739804d38ee199434591a93ab
Introduced
0b195ef5db76c02fb5392ec1418c58bdc5537d41
Fixed
3d0ec7e7c5ae4cd3f9b99d915276926d799b9a2b
Introduced
7b3d6ae79e9153a2477668062f5622c10333925f
Fixed
c5569e6aa03be8ac1a9343d39685a844155a2fc1
Introduced
39d67168cdb6911ffdc961381314b6fed62e3c93
Fixed
254cb7a02d5804d4e466198212cda9d3575ad381
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "24.0.13"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "25.0.0"
                },
                {
                    "fixed": "36.0.14"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "37.0.0"
                },
                {
                    "fixed": "46.0.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "47.0.0"
                },
                {
                    "fixed": "47.0.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

cranelift-v0.*
cranelift-v0.60.0
cranelift-v0.61.0
cranelift-v0.69.0
Other
dev
v0.*
v0.12.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v24.*
v24.0.0
v24.0.1
v24.0.10
v24.0.11
v24.0.12
v24.0.2
v24.0.3
v24.0.4
v24.0.5
v24.0.6
v24.0.7
v24.0.8
v24.0.9
v36.*
v36.0.0
v36.0.1
v36.0.10
v36.0.11
v36.0.12
v36.0.13
v36.0.2
v36.0.3
v36.0.4
v36.0.5
v36.0.6
v36.0.7
v36.0.8
v36.0.9
v46.*
v46.0.0
v46.0.1
v46.0.2
v47.*
v47.0.0
v47.0.1
v47.0.2
v47.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115392.json"