CVE-2026-111433

Name of the Vulnerable Software and Affected Versions iSulad versions prior to 2.1.7

Description A symbolic link (symlink) following issue exists in the src/daemon/modules/spec/specs mount.c file. An attacker who convinces a victim or platform to run a specially crafted malicious image can trick the iSulad daemon into copying sensitive host directories into an anonymous volume during container creation, allowing the container to read those files.

Recommendations Update iSulad to version 2.1.7 or later.