Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N C H H N 8.4 .0050 41.1 —
AFFECTED Product Versions Fixed Multipass unspecified —
TIMELINE May 28 EXPLOIT PUBLISHED — CVE-2026-49238 (Canonical Multipass). Public exploit reference added. May 28 Reserved by canonical May 28 Published (CNA: canonical)
An issue was discovered in Canonical Multipass before version 1.16.3. The host-side SFTP server component (sshfs_server), which executes with root privileges on the host, contains a path containment bypass vulnerability within its validate_path function in src/sshfs_mount/sftp_server.cpp. The function performs a plain string prefix comparison on requested paths without path separator validation or dot-dot (..) normalization. A local attacker with root privileges inside a guest virtual machine can bypass the FUSE layer by injecting raw SFTP frames (such as an SSH_FXP_OPEN request) directly into the sshfs_server process stdin/stdout pipes via procfs. By supplying a path containing directory traversal sequences that match the allowed mount prefix, the attacker can force the host-side root process to resolve the traversal and open files outside the designated mount boundary. This allows a guest-side user to read arbitrary files on the host filesystem, resulting in a virtual machine escape.
| Date | Event | Detail |
|---|---|---|
| May 28, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-49238 (Canonical Multipass). Public exploit reference added. |
| May 28, 2026 | Reserved | Reserved by canonical |
| May 28, 2026 | Published | Published (CNA: canonical) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Canonical | Multipass | — | — | — |
Authoritative record: CVE-2026-49238 at cve.org
Vendors: canonical
Weaknesses: CWE-22
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-49238 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.