High severity · published Oct 28, 2026
CVE-2026-118688
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename
New
7.9
CVSS
–
EPSS
No
On KEV
Description
wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to move host directories into its sandbox and read or write them.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wasmtime · bytecodealliance
before 36.0.18; 37.0.0 before 48.0.6; 49.0.0 before 49.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118688
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118688
vendor-advisory
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38
third-party-advisory
https://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-sandbox-escape-via-symlink-rename
More from wasmtime
10.0
CVE-2024-51745
Wasmtime doesn't fully sandbox all the Windows device filenames
9.9
CVE-2026-115893
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
CVE-2026-115889
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
CVE-2026-115384
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
9.9
CVE-2026-34987
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access