CVE-2026-46703: Boxlite Sandbox Service RCE Vulnerability

CVE-2026-46703 Overview

CVE-2026-46703 is a path traversal vulnerability in Boxlite, a sandbox service that runs Open Container Initiative (OCI) containers inside lightweight virtual machines for executing untrusted code. Versions prior to 0.9.0 fail to validate symbolic link entries when extracting tar archives from OCI images. An attacker can publish a malicious OCI image to a registry such as DockerHub, and any user who pulls and loads that image triggers arbitrary file writes on the host. The write primitive enables remote code execution on the host system, breaking the sandbox boundary Boxlite is designed to enforce.

Critical Impact
A crafted OCI image can write arbitrary content to any path on the Boxlite host, leading to remote code execution outside the sandbox.

Affected Products

Boxlite versions prior to 0.9.0
Hosts running Boxlite that pull OCI images from untrusted registries
Environments using Boxlite to execute untrusted code in lightweight VMs

Discovery Timeline

2026-06-10 - CVE-2026-46703 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46703

Vulnerability Analysis

The flaw is classified as a path traversal weakness [CWE-22] in Boxlite's OCI image extraction logic. When Boxlite unpacks the tar layers contained in an OCI image, it processes each entry without validating whether symbolic link targets resolve to absolute paths outside the intended extraction directory. A tar entry can declare a symlink pointing to an absolute filesystem location such as /etc or /usr/bin, and subsequent file entries written through that symlink land on the host filesystem rather than inside the sandbox staging area.

The attack requires user interaction because a victim must pull and load the malicious image. Because Boxlite is designed to handle untrusted code, image loading is a routine operation, lowering the practical barrier to exploitation. Successful exploitation produces a sandbox escape and host compromise, undermining the security guarantees of the entire Boxlite trust model.

Root Cause

The extraction routine processes tar headers sequentially without re-canonicalizing paths after symlinks are created. The code does not reject absolute symlink targets and does not verify that the final resolved path remains within the extraction root. This pattern is a known tar-extraction anti-pattern documented in multiple container runtime CVEs.

Attack Vector

An attacker builds an OCI image containing a tar layer with two crafted entries: a symlink entry whose target is an absolute host path, followed by a regular file entry written through that symlink. The attacker publishes the image to DockerHub or another public registry under a plausible name. When a Boxlite user runs the image, extraction writes the attacker-controlled file to the host. Writing to locations such as cron directories, shell profiles, or systemd unit paths converts the arbitrary write into code execution under the privileges of the Boxlite process.

No synthetic exploit code is reproduced here. Refer to the GitHub Security Advisory GHSA-f396-4rp4-7v2j for vendor-supplied technical detail.

Detection Methods for CVE-2026-46703

Indicators of Compromise

Unexpected files appearing in host paths such as /etc/cron.d/, /root/.ssh/authorized_keys, or /etc/systemd/system/ after an OCI image load
Boxlite process activity writing outside its designated sandbox or extraction directory
OCI image layers containing tar entries with symlinks pointing to absolute paths like /etc, /usr, or /root
New or modified persistence artifacts created in close time proximity to a boxlite image pull or run command

Detection Strategies

Inspect OCI image layers prior to use with tooling that lists tar entry types and flags absolute symlink targets
Monitor filesystem changes outside the expected Boxlite extraction directory using file integrity monitoring
Correlate Boxlite process execution events with subsequent writes to sensitive system paths
Audit the registries and image digests used by Boxlite hosts and alert on images sourced from untrusted publishers

Monitoring Recommendations

Enable auditd or eBPF-based syscall monitoring for symlinkat, openat, and write calls originating from the Boxlite process
Log the full image reference and digest for every Boxlite load operation to support post-incident triage
Alert on creation of executable files in system directories by non-package-manager processes

How to Mitigate CVE-2026-46703

Immediate Actions Required

Upgrade Boxlite to version 0.9.0 or later on all hosts running the service
Audit recently loaded OCI images for tar entries containing absolute-path symlinks
Restrict image pulls to a curated allowlist of trusted registries and publishers until upgrades complete
Review host filesystem integrity in paths writable by the Boxlite process for unauthorized modifications

Patch Information

The maintainers fixed the symlink handling logic in Boxlite 0.9.0. See the GitHub Boxlite Release v0.9.0 notes and the GitHub Security Advisory GHSA-f396-4rp4-7v2j for full remediation details.

Workarounds

Avoid loading OCI images sourced from public registries until the host is patched
Pre-scan images with a tar inspection step that rejects entries whose symlink targets begin with / or contain ..
Run the Boxlite service under a dedicated unprivileged user with restrictive filesystem permissions to limit blast radius
Apply mandatory access control profiles such as AppArmor or SELinux to constrain Boxlite's writable paths

bash

# Upgrade Boxlite to the patched release
git clone https://github.com/boxlite-ai/boxlite.git
cd boxlite
git checkout v0.9.0
# Follow project build and deployment instructions for v0.9.0