{"id":"AZL-111068","summary":"CVE-2026-115392 affecting package rpm-ostree 2024.4-11","details":"Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.","modified":"2026-10-26T05:32:42Z","published":"2026-10-22T19:17:46Z","upstream":["CVE-2026-115392"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115392"}],"affected":[{"package":{"name":"rpm-ostree","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/rpm-ostree"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2024.4-11"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111068.json"}}],"schema_version":"1.9.0"}