CVE-2026-1386CWE-61

Arbitrary Host File Overwrite via Symlink in Firecracker Jailer

Medium · published January 23, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
11.1
In the wild
Unconfirmed
What it is

A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges.

To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H
EPSS
0.00214 · 11.1th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-01-23T20:25Z
EPSS history
Timeline
  • 23 JAN 20:25Z
    Arbitrary Host File Overwrite via Symlink in Firecracker Jailer
    cvelistv5