- Reported
-
- Issued
-
- Package
-
cap-primitives
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#sandbox
#symlink
#path-traversal
- Aliases
-
- References
-
- Related
-
- CVSS Score
- 9
CRITICAL
- CVSS Details
-
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Changed
- Confidentiality Impact
- High
- Integrity Impact
- High
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- Patched
-
Description
cap-primitives resolves a path inside a sandboxed directory one component at a time and opens the last component with O_NOFOLLOW, so that a symlink there cannot lead out of the directory. When the path ended in /, the resolver added the slash back to the last component before opening it. With a trailing slash the operating system no longer treats that component as the last one, so O_NOFOLLOW does not apply, the symlink is followed, and the resulting file descriptor was returned without further checks.
A symlink inside the sandbox that points outside it, such as escape -> ../outside or a link to /, can therefore be opened as escape/. If the symlink's own target ends in /, the caller's path does not need a trailing slash at all, so removing trailing slashes from untrusted input is not a workaround. The maintainers' advisory reports reads and writes outside the sandbox through open, open_dir, read_dir and canonicalize, and directory creation, removal and renames outside it through create_dir, remove_dir and rename.
This resolver is used on Windows and macOS, on FreeBSD when O_RESOLVE_BENEATH is not available, and on Linux when openat2 is not available (kernels before 5.6, or a seccomp policy that rejects it). cap-std and other crates built on cap-primitives are affected through it. Wasmtime's WASI filesystem support was affected as well; that is covered by RUSTSEC-2026-0269.
The fix stops re-adding the trailing slash and is in 3.4.6 and 4.0.3.
Advisory available under CC0-1.0
license.