The vulnerability is a symlink following flaw in the cp.sh, rcp.sh, and jcp.sh scripts of Bastille. Jailed users can plant symbolic links that point to paths outside the jail. When the copy commands run, the links are dereferenced, allowing attackers to read or overwrite files on the host system with root privileges. This results in a privilege escalation and jail escape.

This issue affects all installations of BastilleBSD Bastille up through version 1.4.4. The flaw appears in the copy and remote copy utilities when executed by a user inside a FreeBSD jail. Users running Bastille on systems that rely on jails for isolation are potentially impacted. No other versions were reported before the fix.

The CVSS base score of 5.3 indicates a moderate impact. While the EPSS score is not available, the absence from the KEV catalog suggests no public exploits are documented. The attack vector is assumed to be local, requiring an attacker already inside a jail to manipulate symlinks; if this condition is met, the exploit is straightforward and requires no additional software. Administrators should treat this as a patchable flaw that can have significant security consequences if left unaddressed.