Improper access control in boxlite - CVE-2026-46695
Published: June 12, 2026 / Updated: July 28, 2026
Vulnerability details
The vulnerability allows a remote attacker to modify files on the host that are intended to be mounted as read-only, potentially leading to execute arbitrary code on the host.
The vulnerability exists due to improper access control in the virtiofs read-only mount enforcement in boxlite when running untrusted code inside a sandboxed container with a host directory mounted as read-only. A remote attacker can remount the shared directory in read-write mode and modify host files to modify files on the host that are intended to be mounted as read-only, potentially leading to execute arbitrary code on the host.
The issue stems from boxlite relying on guest-side mount flags for read-only enforcement while granting container capabilities such as CAP_SYS_ADMIN, allowing the guest to remount the share.