Symlink Following Affecting crun package, versions <1.28-r0
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ALPINE323-CRUN-17996942
- published17 Jul 2026
- disclosed14 Aug 2026
Introduced: 17 Jul 2026
CVE-2026-47766 (opens in a new tab)How to fix?
Upgrade Alpine:3.23 crun to version 1.28-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream crun package and not the crun package as distributed by Alpine.
See How to fix? for Alpine:3.23 relevant fixed versions and status.
crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without O_NOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that symlink and creates the default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay, this created fixed device nodes and symlinks outside the rootfs before crun returned failure. A pre-existing file named ptmx in the target directory was also replaced by crun's forced ptmx -> pts/ptmx symlink. Version 1.28 fixes the issue.