File and Path Handling

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. Wasmtime doesn't fully sandbox all the Windows device filenamesCVE-2024-51745bytecodealliance · CVSS 2.3 · 0.8% likely

   CWE-67

2. cap-std doesn't fully sandbox all the Windows device filenamesCVE-2024-51756bytecodealliance · CVSS 2.3 · 0.6% likely

   CWE-22

3. iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi featureCVE-2025-43853bytecodealliance · CVSS 7 · 0.3% likely

   CWE-61

4. Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink RenameCVE-2026-118688bytecodealliance · CVSS 7.9 · 0.2% likely

   CWE-61

5. Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing SlashesCVE-2026-115392bytecodealliance · CVSS 7.9 · 0.2% likely

   CWE-61

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.