---
id: CVE-2026-119704
title: 'Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp'
summary: >-
  Bastille through 1.4.4 contains a symlink following vulnerability in the
  cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail
  isolation. Attackers inside a jail can plant symlinks pointing to host paths
  or other j…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-59
vendor: BastilleBSD
product: bastille
affected:
  - bastille <= 1.4.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-05T21:46:41.150541Z'
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:46:59.082Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119704'
references:
  - url: 'https://github.com/BastilleBSD/bastille/issues/1673'
    label: 'GitHub Issue #1673'
  - url: 'https://github.com/BastilleBSD/bastille'
  - url: >-
      https://github.com/BastilleBSD/bastille/commit/accc246ba92602c355afc66d0d8b9d43277532e1
  - url: >-
      https://github.com/BastilleBSD/bastille/blob/1.4.4/usr/local/share/bastille/cp.sh#L98-L110
  - url: >-
      https://www.vulncheck.com/advisories/bastille-through-1.4.4-jail-escape-via-symlink-following-in-cp-rcp-jcp
    label: >-
      VulnCheck Advisory: Bastille through 1.4.4 Jail Escape via Symlink
      Following in cp, rcp, jcp
tags:
  - cve.org
epss: 0.00141
epssPercentile: 0.03427
ingestedAt: '2026-11-05T16:07:30.390Z'
---

## Overview

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges.

## Affected

- `bastille <= 1.4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.