{"id":"CVE-2026-46703","aliases":["RUSTSEC-2026-0148","GHSA-f396-4rp4-7v2j","GO-2026-5344","PYSEC-2026-298"],"title":"OCI layer symlink escape → arbitrary host write","summary":"OCI layer symlink escape → arbitrary host write","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendor":"boxlite","product":"boxlite","ecosystem":"rust","affected":["boxlite >= 0.0.0-0, < 0.9.0"],"patched":["boxlite 0.9.0"],"published":"2026-05-16","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:13.556256982Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0148","references":[{"url":"https://crates.io/crates/boxlite"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0148.html"},{"url":"https://github.com/boxlite-ai/boxlite/pull/429"},{"url":"https://github.com/boxlite-ai/boxlite/pull/429"},{"url":"https://github.com/boxlite-ai/boxlite/pull/446"},{"url":"https://github.com/boxlite-ai/boxlite/pull/461"},{"url":"https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-f396-4rp4-7v2j"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46703"},{"url":"https://github.com/boxlite-ai/boxlite"},{"url":"https://github.com/boxlite-ai/boxlite/releases/tag/v0.9.0"}],"tags":["osv","rust","pip"],"epss":0.00482,"epssPercentile":0.41368,"ingestedAt":"2026-09-12T03:13:01.690Z","slug":"CVE-2026-46703","body":"## Overview\n\nAffected versions of `boxlite` extract OCI image layer tarballs without\nfully containing path resolution to the extraction root. A crafted layer\ncontaining a symlink whose target is an absolute on-host path (e.g.\n`escape -> /tmp`) followed by a file entry that resolves through that\nsymlink (e.g. `escape/<path>/pwned.txt`) caused the extractor to write\nthe payload to the host filesystem outside the intended rootfs directory.\n\nThe fix in v0.9.0 routes every destructive filesystem operation through a\n`SafeRoot` handle (`openat2(RESOLVE_IN_ROOT)` on Linux, lexical fallback\nelsewhere) so that no tar entry can resolve outside the extraction root,\neven with adversarial symlinks placed by earlier entries in the same\nlayer.\n\nThis is a container-escape during image extraction, exploitable by any\nuser who pulls or loads a malicious OCI image — including via\n`SimpleBox(rootfs_path=...)` from an untrusted local layout.\n\n## Affected packages\n\n- `boxlite >= 0.0.0-0, < 0.9.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `boxlite 0.9.0`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":219659,"id":"CVE-2026-46703","ts":1791892004949,"field":"cvss","old":"9.6","new":"10"}]}