CVE-2026-118688

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.18 Wasmtime versions 37.0.0 through 48.0.5 Wasmtime versions 49.0.0 through 49.0.2

Description The wasmtime-wasi component re-appends a trailing slash to rename source paths. On macOS and FreeBSD hosts, this causes the renameat() function to follow directory symlinks. A guest with sandbox write access can exploit this by renaming a relative symlink, such as up/, to move host directories into the sandbox, enabling unauthorized read and write access to those directories.

Recommendations Update to version 36.0.18 or later. Update to version 48.0.6 or later. Update to version 49.0.3 or later.