CVE-2026-46703Critical· 10.0▾ MidnightOCI layer symlink escape → arbitrary host write
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.5%
0.5% → 0.8%
Last analysed / modified upstream
9.6 → 10
Affected versions of boxlite extract OCI image layer tarballs without
fully containing path resolution to the extraction root. A crafted layer
containing a symlink whose target is an absolute on-host path (e.g.
escape -> /tmp) followed by a file entry that resolves through that
symlink (e.g. escape/<path>/pwned.txt) caused the extractor to write
the payload to the host filesystem outside the intended rootfs directory.
The fix in v0.9.0 routes every destructive filesystem operation through a
SafeRoot handle (openat2(RESOLVE_IN_ROOT) on Linux, lexical fallback
elsewhere) so that no tar entry can resolve outside the extraction root,
even with adversarial symlinks placed by earlier entries in the same
layer.
This is a container-escape during image extraction, exploitable by any
user who pulls or loads a malicious OCI image — including via
SimpleBox(rootfs_path=...) from an untrusted local layout.
boxlite >= 0.0.0-0, < 0.9.0Upgrade to a patched release:
boxlite 0.9.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.