{"id":"CVE-2026-47261","aliases":["DEBIAN-CVE-2026-47261","EUVD-2026-37001","GHSA-2r75-cxrj-cmph","JLSEC-2026-1366","RUSTSEC-2026-0149","UBUNTU-CVE-2026-47261"],"status":"published","title":"Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction","description":"Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling OpenFlags::TRUNCATE in crates/wasi/src/filesystem.rs (Dir::open_at, lines 967–969) did not set open_mode |= OpenMode::WRITE;, which is later used for the access control check against FilePerms to determine whether opening the file is permitted; the single-line fix adds that missing assignment, after which the affected calls correctly fail with error-code.not-permitted and ERRNO_PERM respectively. Only wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ are affected by this bug. In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. This issue has been fixed in versions 24.0.9, 36.0.10 and44.0.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00357,"percentile":0.29697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2026-05-21T12:00:00Z","modified":"2026-10-28T02:30:28Z","fixes":[{"ecosystem":"crates.io","package":"wasmtime-wasi","fixed_in":["44.0.2","36.0.10","24.0.9","45.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"rust-wasmtime","fixed_in":["36.0.11+dfsg-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Wasmtime_jll","fixed_in":["45.0.1+0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime-wasi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"37.0.0"},{"fixed":"44.0.2"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime-wasi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0"},{"fixed":"36.0.10"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime-wasi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.0.1+dfsg-10","26.0.1+dfsg-3","26.0.1+dfsg-4","26.0.1+dfsg-5","26.0.1+dfsg-6","26.0.1+dfsg-7","26.0.1+dfsg-8","26.0.1+dfsg-9","27.0.0+dfsg-2","27.0.0+dfsg-3","27.0.0+dfsg-4","28.0.1+dfsg-1","28.0.1+dfsg-2","28.0.1+dfsg-3","29.0.1+dfsg-1","29.0.1+dfsg-2","29.0.1+dfsg-3","29.0.1+dfsg-4","29.0.1+dfsg-5","29.0.1+dfsg-6","29.0.1+dfsg-7","29.0.1+dfsg-8","36.0.11+dfsg-1","36.0.12+dfsg-1","36.0.12+dfsg-2","36.0.12+dfsg-3","36.0.13+dfsg-1","36.0.5+dfsg-1","36.0.5+dfsg-2","36.0.5+dfsg-3","36.0.5+dfsg-4","36.0.5+dfsg-5","36.0.6+dfsg-1","36.0.6+dfsg-2","36.0.6+dfsg-3","36.0.6+dfsg-4","36.0.6+dfsg-5","36.0.6+dfsg-6","36.0.6+dfsg-7","36.0.7+dfsg-1","36.0.8+dfsg-1","36.0.9+dfsg-1","36.0.9+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36.0.11+dfsg-1"}]}],"versions":["26.0.1+dfsg-10","26.0.1+dfsg-3","26.0.1+dfsg-4","26.0.1+dfsg-5","26.0.1+dfsg-6","26.0.1+dfsg-7","26.0.1+dfsg-8","26.0.1+dfsg-9","27.0.0+dfsg-2","27.0.0+dfsg-3","27.0.0+dfsg-4","28.0.1+dfsg-1","28.0.1+dfsg-2","28.0.1+dfsg-3","29.0.1+dfsg-1","29.0.1+dfsg-2","29.0.1+dfsg-3","29.0.1+dfsg-4","29.0.1+dfsg-5","29.0.1+dfsg-6","29.0.1+dfsg-7","29.0.1+dfsg-8","36.0.5+dfsg-1","36.0.5+dfsg-2","36.0.5+dfsg-3","36.0.5+dfsg-4","36.0.5+dfsg-5","36.0.6+dfsg-1","36.0.6+dfsg-2","36.0.6+dfsg-3","36.0.6+dfsg-4","36.0.6+dfsg-5","36.0.6+dfsg-6","36.0.6+dfsg-7","36.0.7+dfsg-1","36.0.8+dfsg-1","36.0.9+dfsg-1","36.0.9+dfsg-2"]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime-wasi","ranges":[{"type":"SEMVER","events":[{"introduced":"37.0.0"},{"fixed":"44.0.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime-wasi","ranges":[{"type":"SEMVER","events":[{"introduced":"25.0.0"},{"fixed":"36.0.10"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime-wasi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"24.0.9"}]}]},{"source":"osv","ecosystem":"Julia","package":"Wasmtime_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"45.0.1+0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime-wasi","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"24.0.9"},{"introduced":"25.0.0"},{"fixed":"36.0.10"},{"introduced":"37.0.0"},{"fixed":"44.0.2"},{"introduced":"45.0.0"},{"fixed":"45.0.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.1+dfsg-7","15.0.1+dfsg-4","16.0.0+dfsg-2","16.0.0+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.0.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["36.0.5+dfsg-1","36.0.13+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.0.1+dfsg-3","26.0.1+dfsg-4","28.0.1+dfsg-3","29.0.1+dfsg-5","36.0.5+dfsg-1"]}],"products":[{"vendor":"bytecodealliance","product":"wasmtime"}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2r75-cxrj-cmph","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.9","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.10","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v44.0.2","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0149.html","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47261","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-2r75-cxrj-cmph","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47261.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-47261","tags":["advisory"]},{"url":"https://github.com/bytecodealliance/wasmtime","tags":["package"]},{"url":"https://crates.io/crates/wasmtime-wasi","tags":["package"]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/13429","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-47261","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47261","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-47261","title":"Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction","description":"Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling OpenFlags::TRUNCATE in crates/wasi/src/filesystem.rs (Dir::open_at, lines 967–969) did not set open_mode |= OpenMode::WRITE;, which is later used for the access control check against FilePerms to determine whether opening the file is permitted; the single-line fix adds that missing assignment, after which the affected calls correctly fail with error-code.not-permitted and ERRNO_PERM respectively. Only wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ are affected by this bug. In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. This issue has been fixed in versions 24.0.9, 36.0.10 and44.0.2.","status":"published","published":"2026-06-15T19:47:40.366Z","modified":"2026-06-16T12:46:04.26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-37001","description":"Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling OpenFlags::TRUNCATE in crates/wasi/src/filesystem.rs (Dir::open_at, lines 967–969) did not set open_mode |= OpenMode::WRITE;, which is later used for the access control check against FilePerms to determine whether opening the file is permitted; the single-line fix adds that missing assignment, after which the affected calls correctly fail with error-code.not-permitted and ERRNO_PERM respectively. Only wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ are affected by this bug. In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. This issue has been fixed in versions 24.0.9, 36.0.10 and44.0.2.","status":"published","published":"2026-06-15T19:47:40Z","modified":"2026-06-16T12:46:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:40.605509Z"}],"ghsa":[{"id":"GHSA-2r75-cxrj-cmph","title":"wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction","description":"## Summary\n\nIn `wasmtime-wasi`, when a filesystem preopen is given `DirPerms::all()` and `FilePerms::READ` without `FilePerms::WRITE`,  this wasmtime-wasi enforced access control mechanism can be bypassed by using the wasip2 `descriptor.open-at` or wasip1 `path_open` interfaces by opening a file with `OpenFlags::TRUNCATE` oflag only, for example:\n\n```rust\ndir_descriptor.open_at(\n   PathFlags::empty(),\n   FILENAME,\n   OpenFlags::TRUNCATE,\n   DescriptorFlags::READ,\n)\n```\n\n```rust\nwasip1::path_open(\n    dir_fd,\n    0,\n    FILENAME,\n    wasip1::OFLAGS_TRUNC,\n    wasip1::RIGHTS_FD_READ,\n    0,\n    0\n)\n```\n\nThe root cause is that the clause that considered `OpenFlags::TRUNCATE` did not set `open_mode |= OpenMode::WRITE;`, used later in that function for the access control check against `FilePerms` for whether opening that file is permitted. With the bug corrected, these calls to `open-at` and `path_open` fail with `error-code.not-permitted` and `ERRNO_PERM` respectively.\n\nThe bug in `crates/wasi/src/filesystem.rs`, `Dir::open_at`, lines 967–969:\n\n```rust\nif oflags.contains(OpenFlags::TRUNCATE) {\n    opts.truncate(true).write(true);\n}\n```\nand the single line fix is:\n```rust\nif oflags.contains(OpenFlags::TRUNCATE) {\n    opts.truncate(true).write(true);\n    open_mode |= OpenMode::WRITE;\n}\n```\n\nOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ are affected by this bug, e.g. those that use in the `WasiCtxBuilder`:\n```rust\nbuilder.preopened_dir(\"readonly\", \"readonly\", DirPerms::READ | DirPerms::MUTATE, FilePerms::READ);\n```\n\nIn particular, the Wasmtime project's `wasmtime-cli`'s use of wasmtime-wasi is not affected, because it always sets `FilePerms::all()` for all preopens.","status":"published","published":"2026-06-05T15:47:02Z","modified":"2026-07-08T17:35:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:40:40.389795Z"}],"nvd":[{"id":"CVE-2026-47261","description":"Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling OpenFlags::TRUNCATE in crates/wasi/src/filesystem.rs (Dir::open_at, lines 967–969) did not set open_mode |= OpenMode::WRITE;, which is later used for the access control check against FilePerms to determine whether opening the file is permitted; the single-line fix adds that missing assignment, after which the affected calls correctly fail with error-code.not-permitted and ERRNO_PERM respectively. Only wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ are affected by this bug. In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. This issue has been fixed in versions 24.0.9, 36.0.10 and44.0.2.","status":"published","published":"2026-06-15T21:17:11.153Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:24.19758Z"}],"osv":[{"id":"CVE-2026-47261","title":"Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction","description":"Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling OpenFlags::TRUNCATE in crates/wasi/src/filesystem.rs (Dir::open_at, lines 967–969) did not set open_mode |= OpenMode::WRITE;, which is later used for the access control check against FilePerms to determine whether opening the file is permitted; the single-line fix adds that missing assignment, after which the affected calls correctly fail with error-code.not-permitted and ERRNO_PERM respectively. Only wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ are affected by this bug. In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. This issue has been fixed in versions 24.0.9, 36.0.10 and44.0.2.","status":"published","published":"2026-06-15T19:47:40.366Z","modified":"2026-10-28T02:30:28.146395878Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:45:06.231145Z"},{"id":"DEBIAN-CVE-2026-47261","description":"Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling OpenFlags::TRUNCATE in crates/wasi/src/filesystem.rs (Dir::open_at, lines 967–969) did not set open_mode |= OpenMode::WRITE;, which is later used for the access control check against FilePerms to determine whether opening the file is permitted; the single-line fix adds that missing assignment, after which the affected calls correctly fail with error-code.not-permitted and ERRNO_PERM respectively. Only wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ are affected by this bug. In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. This issue has been fixed in versions 24.0.9, 36.0.10 and44.0.2.","status":"published","published":"2026-06-15T21:17:11.153Z","modified":"2026-10-26T11:47:24.625477034Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-2r75-cxrj-cmph","title":"wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction","description":"## Summary\n\nIn `wasmtime-wasi`, when a filesystem preopen is given `DirPerms::all()` and `FilePerms::READ` without `FilePerms::WRITE`,  this wasmtime-wasi enforced access control mechanism can be bypassed by using the wasip2 `descriptor.open-at` or wasip1 `path_open` interfaces by opening a file with `OpenFlags::TRUNCATE` oflag only, for example:\n\n```rust\ndir_descriptor.open_at(\n   PathFlags::empty(),\n   FILENAME,\n   OpenFlags::TRUNCATE,\n   DescriptorFlags::READ,\n)\n```\n\n```rust\nwasip1::path_open(\n    dir_fd,\n    0,\n    FILENAME,\n    wasip1::OFLAGS_TRUNC,\n    wasip1::RIGHTS_FD_READ,\n    0,\n    0\n)\n```\n\nThe root cause is that the clause that considered `OpenFlags::TRUNCATE` did not set `open_mode |= OpenMode::WRITE;`, used later in that function for the access control check against `FilePerms` for whether opening that file is permitted. With the bug corrected, these calls to `open-at` and `path_open` fail with `error-code.not-permitted` and `ERRNO_PERM` respectively.\n\nThe bug in `crates/wasi/src/filesystem.rs`, `Dir::open_at`, lines 967–969:\n\n```rust\nif oflags.contains(OpenFlags::TRUNCATE) {\n    opts.truncate(true).write(true);\n}\n```\nand the single line fix is:\n```rust\nif oflags.contains(OpenFlags::TRUNCATE) {\n    opts.truncate(true).write(true);\n    open_mode |= OpenMode::WRITE;\n}\n```\n\nOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ are affected by this bug, e.g. those that use in the `WasiCtxBuilder`:\n```rust\nbuilder.preopened_dir(\"readonly\", \"readonly\", DirPerms::READ | DirPerms::MUTATE, FilePerms::READ);\n```\n\nIn particular, the Wasmtime project's `wasmtime-cli`'s use of wasmtime-wasi is not affected, because it always sets `FilePerms::all()` for all preopens.","status":"published","published":"2026-06-05T15:47:02Z","modified":"2026-09-10T03:51:07.52022571Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"JLSEC-2026-1366","title":"wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction","description":"## Summary\n\nIn `wasmtime-wasi`, when a filesystem preopen is given `DirPerms::all()` and `FilePerms::READ` without `FilePerms::WRITE`,  this wasmtime-wasi enforced access control mechanism can be bypassed by using the wasip2 `descriptor.open-at` or wasip1 `path_open` interfaces by opening a file with `OpenFlags::TRUNCATE` oflag only, for example:\n\n```rust\ndir_descriptor.open_at(\n   PathFlags::empty(),\n   FILENAME,\n   OpenFlags::TRUNCATE,\n   DescriptorFlags::READ,\n)\n```\n\n```rust\nwasip1::path_open(\n    dir_fd,\n    0,\n    FILENAME,\n    wasip1::OFLAGS_TRUNC,\n    wasip1::RIGHTS_FD_READ,\n    0,\n    0\n)\n```\n\nThe root cause is that the clause that considered `OpenFlags::TRUNCATE` did not set `open_mode |= OpenMode::WRITE;`, used later in that function for the access control check against `FilePerms` for whether opening that file is permitted. With the bug corrected, these calls to `open-at` and `path_open` fail with `error-code.not-permitted` and `ERRNO_PERM` respectively.\n\nThe bug in `crates/wasi/src/filesystem.rs`, `Dir::open_at`, lines 967–969:\n\n```rust\nif oflags.contains(OpenFlags::TRUNCATE) {\n    opts.truncate(true).write(true);\n}\n```\n\nand the single line fix is:\n\n```rust\nif oflags.contains(OpenFlags::TRUNCATE) {\n    opts.truncate(true).write(true);\n    open_mode |= OpenMode::WRITE;\n}\n```\n\nOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ are affected by this bug, e.g. those that use in the `WasiCtxBuilder`:\n\n```rust\nbuilder.preopened_dir(\"readonly\", \"readonly\", DirPerms::READ | DirPerms::MUTATE, FilePerms::READ);\n```\n\nIn particular, the Wasmtime project's `wasmtime-cli`'s use of wasmtime-wasi is not affected, because it always sets `FilePerms::all()` for all preopens.","status":"published","published":"2026-08-21T20:43:33.133Z","modified":"2026-08-21T21:14:20.305686649Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"RUSTSEC-2026-0149","title":"WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction","description":"This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2r75-cxrj-cmph\nFor more information see the GitHub-hosted security advisory.","status":"published","published":"2026-05-21T12:00:00Z","modified":"2026-10-12T18:00:09.236693447Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"UBUNTU-CVE-2026-47261","description":"Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling OpenFlags::TRUNCATE in crates/wasi/src/filesystem.rs (Dir::open_at, lines 967–969) did not set open_mode |= OpenMode::WRITE;, which is later used for the access control check against FilePerms to determine whether opening the file is permitted; the single-line fix adds that missing assignment, after which the affected calls correctly fail with error-code.not-permitted and ERRNO_PERM respectively. Only wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ are affected by this bug. In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. This issue has been fixed in versions 24.0.9, 36.0.10 and44.0.2.","status":"published","published":"2026-06-15T21:17:00Z","modified":"2026-10-17T13:00:16.762967497Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:30.797112Z"}]}}