Is CVE-2026-119704 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119704?

CVE-2026-119704 has a CVSS v3 severity of MEDIUM (6.8).

Back

CVE-2026-119704

Description

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges.