CVE-2026-47261: Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

Synopsis

An access-control bypass vulnerability affects Wasmtime, the WebAssembly runtime maintained by the Bytecode Alliance. A remote attacker with no authentication can exploit the vulnerability by opening a file through the WASI path_open or wasip2 descriptor.open-at interface using only the TRUNCATE flag, which sidesteps the FilePerms::WRITE check and allows file truncation even when the host embedding explicitly withholds write permission. Successful exploitation allows an attacker to truncate (destroy the contents of) files in a preopened directory, causing data loss and tampering in affected embeddings. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream fix versions are published and indexed.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable WASI interface is reachable over the network (AV:N), so an attacker must be able to send requests to the exposed service.

• AuthenticationNot required

  No credentials or prior account are needed to trigger the vulnerable code path (PR:N).

• Victim interactionNot required

  The attacker does not need any user or administrator to take any action for exploitation to succeed (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental setup are required (AC:L).

Blast Radius

• An attacker can truncate any file inside a preopened directory to zero bytes, permanently destroying its contents.
• Data held in configuration files, database files, or application state files within the preopened scope is at risk of being wiped.
• The integrity impact is high (I:H); there is no confidentiality or availability impact scored, meaning data cannot be read or the service crashed by this specific vector alone.
• Only wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ (without FilePerms::WRITE) are in scope; embeddings that grant FilePerms::all() are not affected.