CVE-2026-118688
wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to move host directories into its sandbox and read or write them.
- Score
- 8.8 high
- Published
- 2026-10-28
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| devel/libwasmtime | libwasmtime | 49.0.2_1 | unaddressed | longros@FreeBSD.org |
Template for a VuXML entry
Package names, ranges and the XML itself can be wrong. Always check the content before you commit it, and run make validate in security/vuxml. The generator is being rewritten from scratch.
Range per package from the fixed version in the CVE rows that match this port, converted to pkg notation and checked with pkg; for ports with a version line in their name (python312) only from that line. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>libwasmtime</name>
<!-- 49.0.3 is not released yet, newest upstream is 49.0.2 -->
<range><lt>49.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and
49.0.0 before 49.0.3 re-appends a trailing slash to rename source
paths, causing renameat on macOS and FreeBSD hosts to follow directory
symlinks. A guest with sandbox write access can rename a relative
symlink such as "up/" to move host directories into its sandbox and
read or write them.</p>
</body>
</description>
<references>
<cvename>CVE-2026-118688</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-118688</url>
</references>
<dates>
<discovery>2026-10-28</discovery>
<entry>2026-10-28</entry>
</dates>
</vuln>