wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing…
wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to move host directories into its sandbox and read or write them.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Bytecodealliance
- Product
- wasmtime
- CVSS v3.1
- 7.9 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
- Weakness
- CWE-61
- Exposure class
- Operating system
- NVD status
- Deferred
Why it ranks 21 (Routine)
- CVSS v3.1 7.9 high
- Product class: operating system
- Widely deployed vendor product (Bytecodealliance)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.