{"api_version":"1","generated_at":"2026-11-12T12:53:28+00:00","cve":"CVE-2026-111433","urls":{"html":"https://cve.report/CVE-2026-111433","api":"https://cve.report/api/cve/CVE-2026-111433.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-111433","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111433"},"summary":{"title":"CVE-2026-111433","description":"UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIf an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.","state":"PUBLISHED","assigner":"openEuler","published_at":"2026-11-12 04:17:17","updated_at":"2026-11-12 10:17:27"},"problem_types":["CWE-61","CWE-61 CWE-61 UNIX symbolic link (symlink) following"],"metrics":[{"version":"3.1","source":"securities@openeuler.org","type":"Secondary","score":"8.6","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.6","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://atomgit.com/src-openeuler/iSulad/pull/812","name":"https://atomgit.com/src-openeuler/iSulad/pull/812","refsource":"securities@openeuler.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865","name":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865","refsource":"securities@openeuler.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://atomgit.com/openeuler/iSulad/commit/3af9a2bf517b570fe20b1ee1070668a6270d6e11?ref=master&prId=2652","name":"https://atomgit.com/openeuler/iSulad/commit/3af9a2bf517b570fe20b1ee1070668a6270d6e11?ref=master&prId=2652","refsource":"securities@openeuler.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111433","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111433","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"openEuler","product":"iSulad","version":"affected 2.1.6 rpm","platforms":["Linux"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Tianyu Tu","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/spec/specs_mount.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"credits":[{"lang":"en","type":"finder","value":"Tianyu Tu"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.<p>This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.</p><p>This issue affects iSulad: through 2.1.6.</p><p>If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.</p>"}],"value":"UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIf an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-61","description":"CWE-61 UNIX symbolic link (symlink) following","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T09:15:38.969Z","orgId":"7e1ac599-2767-43fa-b3ea-f10178cc98f2","shortName":"openEuler"},"references":[{"tags":["patch"],"url":"https://atomgit.com/openeuler/iSulad/commit/3af9a2bf517b570fe20b1ee1070668a6270d6e11?ref=master&prId=2652"},{"tags":["patch"],"url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"tags":["vendor-advisory"],"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"7e1ac599-2767-43fa-b3ea-f10178cc98f2","assignerShortName":"openEuler","cveId":"CVE-2026-111433","datePublished":"2026-11-12T03:45:51.294Z","dateReserved":"2026-10-16T02:50:14.526Z","dateUpdated":"2026-11-12T09:15:38.969Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 04:17:17","lastModifiedDate":"2026-11-12 10:17:27","problem_types":["CWE-61","CWE-61 CWE-61 UNIX symbolic link (symlink) following"],"metrics":{"cvssMetricV31":[{"source":"securities@openeuler.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"111433","Ordinal":"1","Title":"CVE-2026-111433","CVE":"CVE-2026-111433","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"111433","Ordinal":"1","NoteData":"UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIf an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.","Type":"Description","Title":"CVE-2026-111433"}]}}}