BastilleBSD Bastille flaw reportedly lets jailed users escape isolation (EUVD-2026-114109)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- BastilleBSD
- Product
- Bastille
- First seen
Summary
The EUVD database lists EUVD-2026-114109, a symlink-following flaw in Bastille through 1.4.4 affecting the cp.sh, rcp.sh and jcp.sh subcommands. According to the listing, which scores it 5.3/10 (CVSS v3.1), attackers inside a jail can plant symlinks pointing to host paths or other jail roots.
If you use BastilleBSD
Upgrade Bastille to a release newer than 1.4.4 once the vendor publishes a fix
Restrict which users can run jail management commands until patched
Audit jails for symlinks that point to host paths or other jail roots
Check the EUVD entry for updated status and remediation details
What the sources say 1
· Mastodon: “Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation.” Source