CVE-2026-119704— Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp

Quick assessment

Affected

BastilleBSD bastille

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Bastille 1.4.4 及更早版本在、和子命令中存在符号链接跟随（symlink following）漏洞，允许被隔离（jailed）用户突破隔离环境。攻击者可在隔离环境中创建指向主机路径或其他隔离根目录的符号链接，导致以管理员身份运行的复制操作以 root 权限覆盖或读取主机文件。

CVSS 6.8 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1055.001 · Dynamic-link Library Injection

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp

Source: CVE Program / CVE List V5

Vulnerability Description

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

在文件访问前对链接解析不恰当(链接跟随)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
BastilleBSD	bastille	0 ~ 1.4.4	-

II. Public POCs for CVE-2026-119704

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119704

请登录查看更多情报信息。

Other References for CVE-2026-119704 (5)

https://github.com/BastilleBSD/bastille product
https://github.com/BastilleBSD/bastille/commit/accc246ba92602c355afc66d0d8b9d43277532e1 patch
https://github.com/BastilleBSD/bastille/blob/1.4.4/usr/local/share/bastille/cp.sh#L98-L110 technical-description
https://github.com/BastilleBSD/bastille/issues/1673 issue-tracking
https://www.vulncheck.com/advisories/bastille-through-1.4.4-jail-escape-via-symlink-following-in-cp-rcp-jcp third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119704

IV. Related Vulnerabilities

Same weakness: CWE-59