EUVD-2026-32899Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in Canonical Multipass before version 1.16.3. The host-side SFTP server component (sshfs_server), which executes with root privileges on the host, contains a path containment bypass vulnerability within its validate_path function in src/sshfs_mount/sftp_server.cpp. The function performs a plain string prefix comparison on requested paths without path separator validation or dot-dot (..) normalization. A local attacker with root privileges inside a guest virtual machine can bypass the FUSE layer by injecting raw SFTP frames (such as an SSH_FXP_OPEN request) directly into the sshfs_server process stdin/stdout pipes via procfs. By supplying a path containing directory traversal sequences that match the allowed mount prefix, the attacker can force the host-side root process to resolve the traversal and open files outside the designated mount boundary. This allows a guest-side user to read arbitrary files on the host filesystem, resulting in a virtual machine escape.
AnalysisAI
Virtual machine escape in Canonical Multipass before 1.16.3 allows a root user inside a guest VM to read arbitrary files on the host filesystem by bypassing the host-side sshfs_server path containment. The flaw lives in the validate_path function (CWE-22 path traversal), which uses naive string prefix matching and accepts dot-dot sequences. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV, though the technical write-up in the GHSA advisory provides enough detail to make exploitation reproducible.
Technical ContextAI
Multipass is Canonical's lightweight VM orchestrator that uses sshfs/FUSE to mount host directories into guest VMs. The vulnerable component is sshfs_server (src/sshfs_mount/sftp_server.cpp), a host-side helper that runs as root and brokers SFTP traffic for the FUSE mount. Its validate_path function is supposed to ensure that any requested path remains beneath an allowed mount prefix, but it performs only a plain std::string prefix comparison - there is no canonicalisation, no check that the next character after the prefix is a path separator, and no resolution of '..' components, which is the canonical CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) pattern. Because the guest can reach the sshfs_server process's stdin/stdout via /proc on the host-facing side of the pipe and inject raw SFTP frames (e.g. SSH_FXP_OPEN), the attacker bypasses the FUSE layer entirely and speaks directly to the privileged validator.
RemediationAI
Vendor-released patch: upgrade Canonical Multipass to 1.16.3 or later, which is the fixed version cited in the GHSA-rhp2-23c4-r34w advisory (https://github.com/canonical/multipass/security/advisories/GHSA-rhp2-23c4-r34w). Until patching is possible, stop mounting host directories into untrusted guests by avoiding 'multipass mount' and removing existing mounts with 'multipass umount', which eliminates the sshfs_server attack surface but breaks any workflow that depends on shared host folders. Where mounts are required, restrict them to directories that contain no sensitive host content (e.g. a dedicated empty share) and do not grant untrusted users root inside guests, since exploitation requires guest-side root to write raw SFTP frames into the sshfs_server pipes via procfs.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today