CVE-2026-118688

The record

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to move host directories into its sandbox and read or write them.

Affected packages

Related vulnerabilities

• CVE-2026-119336 Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing… CWE-61
• CVE-2026-115908 zip is a zip library for Rust that supports reading and writing simple ZIP files. CWE-61
• CVE-2026-115424 A flaw was found in the OpenShift client oc. CWE-61
• CVE-2026-115392 Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before… CWE-61
• CVE-2026-106566 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-61
• CVE-2026-105712 gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. CWE-61
• CVE-2026-79939 Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link… CWE-61
• CVE-2026-32657 Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1… CWE-61