Symlink-following sandbox escape (arbitrary file write) in bubblewrap before 0.12.0
AI analysis
CVE-2026-87766 is a symlink-following flaw (CWE-59) in bubblewrap, the Linux sandboxing tool: during sandbox setup, when bubblewrap creates files or directories under the new root, it can follow a parent symlink through /oldroot onto the host filesystem. The attack is triggered locally (CVSS AV:L/PR:L) before the sandboxed process starts, by an attacker with low privileges who can influence the sandbox setup, for example a sandboxed application being launched or a nested-bwrap scenario, so that writes land at attacker-chosen paths outside the sandbox. The attacker gains the ability to create or overwrite files and directories on the host with the privileges of the user launching the sandbox, breaking the sandbox boundary (CVSS scope-changed, S:C, with high confidentiality, integrity and availability impact; 8.8 High). Any Linux system running bubblewrap versions prior to 0.12.0 is affected, notably desktop distributions where bubblewrap is pulled in as a Flatpak dependency and other tooling that invokes bwrap for sandboxing. No exploitation is currently known: the flaw is not in CISA KEV, no public proof-of-concept is known, and the issue (GHSA-pxhw-h44j-8pfx, assigned by Red Hat) is fixed upstream in bubblewrap 0.12.0.
What to do: Upgrade bubblewrap to 0.12.0 or install your distribution's patched package, and watch for vendor advisories (the CNA is Red Hat; the issue is tracked as GHSA-pxhw-h44j-8pfx). Check the installed version with bwrap --version and, until patched, avoid launching bwrap sandboxes with attacker-controlled directories or symlinks in the sandbox source tree, and treat nested-sandbox launches as a potential escape vector. No public PoC or in-the-wild exploitation is known, so patching can follow normal maintenance cadence.
Affected
| bubblewrap project (freedesktop.org) bubblewrap | all versions prior to 0.12.0 |
Estimated exposure
masslikely millions of Linux installations (shipped with Flatpak and widely packaged across major distros); exact install counts not published — No install counts were provided in the data, so this is an order-of-magnitude estimate based on deployment patterns: bubblewrap is installed as a dependency of Flatpak and is present by default or in repositories on essentially all major…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.