CVE-2026-47261

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Published

Jun 15, 2026, 7:47:40 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.36% · Oct 25, 2026

A flaw was found in Wasmtime, a runtime for WebAssembly. This vulnerability allows an attacker to bypass intended access controls when a filesystem preopen is configured with read-only file permissions but also allows directory mutations. By using specific open flags, an attacker can truncate files that should not be writable, leading to unauthorized data modification. This issue affects wasmtime-wasi embeddings that combine directory mutation permissions with read-only file permissions. wasmtime-wasi: Wasmtime: Wasmtime: Access control bypass allows unauthorized file truncation via specific open flags. Conditions for Exploitation: Successful exploitation relies on a highly specific configuration of wasmtime-wasi embeddings. The vulnerability only triggers if a filesystem preopen explicitly combines directory mutation permissions (DirPerms::MUTATE) with read-only file permissions (FilePerms::READ). Impact Limitations: The flaw bypasses access controls solely to allow file truncation, resulting in unauthorized data modification or data loss. It does not enable an attacker to inject arbitrary data, read unpermitted files, execute arbitrary code, or escalate privileges on the host system. Specific Components Not Affected: The standard Wasmtime command-line interface (wasmtime-cli) is completely unaffected by this bug, as it defaults to granting full file permissions for all preopens. This significantly reduces the likelihood of widespread exploitation in default deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.