{"id":"GHSA-hp8f-xmx4-4qrg","aliases":["RUSTSEC-2026-0482"],"status":"published","title":"Paths or symlinks ending in a slash escape the sandbox","description":"cap-primitives resolves a path inside a sandboxed directory one component at a time and opens the last component with `O_NOFOLLOW`, so that a symlink there cannot lead out of the directory. When the path ended in `/`, the resolver added the slash back to the last component before opening it. With a trailing slash the operating system no longer treats that component as the last one, so `O_NOFOLLOW` does not apply, the symlink is followed, and the resulting file descriptor was returned without further checks.\n\nA symlink inside the sandbox that points outside it, such as `escape -\u003e ../outside` or a link to `/`, can therefore be opened as `escape/`. If the symlink's own target ends in `/`, the caller's path does not need a trailing slash at all, so removing trailing slashes from untrusted input is not a workaround. The maintainers' advisory reports reads and writes outside the sandbox through `open`, `open_dir`, `read_dir` and `canonicalize`, and directory creation, removal and renames outside it through `create_dir`, `remove_dir` and `rename`.\n\nThis resolver is used on Windows and macOS, on FreeBSD when `O_RESOLVE_BENEATH` is not available, and on Linux when `openat2` is not available (kernels before 5.6, or a seccomp policy that rejects it). cap-std and other crates built on cap-primitives are affected through it. Wasmtime's WASI filesystem support was affected as well; that is covered by RUSTSEC-2026-0269.\n\nThe fix stops re-adding the trailing slash and is in 3.4.6 and 4.0.3.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-20T12:00:00Z","modified":"2026-11-11T08:45:02Z","fixes":[{"ecosystem":"crates.io","package":"cap-primitives","fixed_in":["3.4.6","4.0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"cap-primitives","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"3.4.6"},{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}]}],"references":[{"url":"https://crates.io/crates/cap-primitives","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0482.html","tags":["advisory"]},{"url":"https://github.com/bytecodealliance/cap-std/pull/419","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0482","title":"Paths or symlinks ending in a slash escape the sandbox","description":"cap-primitives resolves a path inside a sandboxed directory one component at a time and opens the last component with `O_NOFOLLOW`, so that a symlink there cannot lead out of the directory. When the path ended in `/`, the resolver added the slash back to the last component before opening it. With a trailing slash the operating system no longer treats that component as the last one, so `O_NOFOLLOW` does not apply, the symlink is followed, and the resulting file descriptor was returned without further checks.\n\nA symlink inside the sandbox that points outside it, such as `escape -\u003e ../outside` or a link to `/`, can therefore be opened as `escape/`. If the symlink's own target ends in `/`, the caller's path does not need a trailing slash at all, so removing trailing slashes from untrusted input is not a workaround. The maintainers' advisory reports reads and writes outside the sandbox through `open`, `open_dir`, `read_dir` and `canonicalize`, and directory creation, removal and renames outside it through `create_dir`, `remove_dir` and `rename`.\n\nThis resolver is used on Windows and macOS, on FreeBSD when `O_RESOLVE_BENEATH` is not available, and on Linux when `openat2` is not available (kernels before 5.6, or a seccomp policy that rejects it). cap-std and other crates built on cap-primitives are affected through it. Wasmtime's WASI filesystem support was affected as well; that is covered by RUSTSEC-2026-0269.\n\nThe fix stops re-adding the trailing slash and is in 3.4.6 and 4.0.3.","status":"published","published":"2026-08-20T12:00:00Z","modified":"2026-11-11T08:45:02.459487612Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-11T08:57:35.149852Z"}]}}