Symlink Following Vulnerability in Bastille by BastilleBSD

CVE-2026-119704

What is CVE-2026-119704?

Bastille versions up to 1.4.4 are susceptible to a symlink following vulnerability in the cp.sh, rcp.sh, and jcp.sh subcommands. This flaw allows users operating within a jail environment to execute a jailbreak by creating symbolic links that point to files outside their controlled directories. Consequently, if an administrator runs commands that handle these symlinks, it may inadvertently lead to the overwriting or reading of sensitive host files with elevated privileges. Address this vulnerability promptly to ensure the security of your systems.

References