CVE-2026-119704

MEDIUM 6.8

Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges.

CWE	CWE-59
Vendor	bastillebsd
Product	bastille
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for bastillebsd bastille

Be the first to know when new medium vulnerabilities affecting bastillebsd bastille are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Affected Versions

BastilleBSD / bastille

0 ≤ 1.4.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/BastilleBSD/bastille/issues/1673 github.com: https://github.com/BastilleBSD/bastille github.com: https://github.com/BastilleBSD/bastille/commit/accc246ba92602c355afc66d0d8b9d43277532e1 github.com: https://github.com/BastilleBSD/bastille/blob/1.4.4/usr/local/share/bastille/cp.sh#L98-L110 vulncheck.com: https://www.vulncheck.com/advisories/bastille-through-1.4.4-jail-escape-via-symlink-following-in-cp-rcp-jcp

Credits

George Chen