CVE-2026-49238: SFTP Server VM Escape in Canonical Multipass

Synopsis

A path containment bypass in the SFTP server component (sshfs_server) of Canonical Multipass before 1.16.3 allows a local attacker with root privileges inside a guest virtual machine to escape the VM boundary. The attacker injects raw SFTP frames directly into the host-side root process via procfs, exploiting a missing path separator validation and dot-dot normalization in the validate_path function. Successful exploitation gives the attacker read access to arbitrary files on the host filesystem and the ability to write arbitrary files there as well, constituting a full virtual machine escape. A patched-image rebuild at version 1.16.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host (or in this case, root access inside a guest VM) and does not require over-the-network access to the vulnerable component.

• AuthenticationRequired

  A low-privilege account (specifically root inside the guest VM) is sufficient; no host-level account is needed, but the attacker must have established privileged access within the guest.

• Victim interactionNot required

  No action from any other user or administrator is needed; the attacker performs the exploit entirely without victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free once the attacker has root inside the guest VM, with no race conditions or special memory layout requirements.

Blast Radius

• Reads arbitrary files on the host filesystem, including credentials, private keys, and configuration files stored outside the VM mount boundary.
• Writes arbitrary files to the host filesystem, allowing the attacker to plant backdoors, modify system binaries, or alter host configuration.
• Breaks the isolation boundary between the guest VM and the host OS, exposing all data accessible to the host-side root process running sshfs_server.