CVE-2026-111433 PUBLISHED

Assigner: openEuler
Reserved: 16.10.2026 Published: 12.11.2026 Updated: 12.11.2026

UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.

This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.

This issue affects iSulad: through 2.1.6.

If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 8.6

Product Status

Vendor openEuler
Product iSulad
Versions Default: affected
  • affected from 0 to 2.1.6 (incl.)

Credits

  • Tianyu Tu finder

References

Problem Types

  • CWE-61 UNIX symbolic link (symlink) following CWE