CVE-2026-119704EUVD-2026-114109GHSA-WRMV-W7W7-JXC9
Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Bastille, a FreeBSD jail management tool, is affected through its cp, rcp, and jcp subcommands. A user inside a jail can use symbolic links to make administrator-run copy operations read or overwrite files on the host system with root privileges, breaking out of jail isolation.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- BastilleBSD bastille
through 1.4.4