An attacker with root privileges inside a guest virtual machine can exploit a path validation flaw in Canonical Multipass’s SFTP server component (sshfs_server) that runs as root on the host. By crafting an SFTP request containing directory traversal sequences and injecting it directly into the sshfs_server’s stdin/stdout via procfs, the guest can cause the host process to resolve paths outside the allowed mount boundary. This allows the guest to read arbitrary files on the host filesystem, effectively escaping the VM. This vulnerability constitutes a privilege escalation from inside the guest to the host, enabling a virtual machine escape.

The flaw exists in all versions of Canonical Multipass released before 1.16.3. Users running any pre-1.16.3 build of Multipass are potentially vulnerable. No specific sub-versions are listed, but the entire product line up to 1.16.2 is affected.

With a CVSS score of 8.4, this vulnerability presents a high severity risk. The exploit requires local root privileges inside the VM and the ability to manipulate the sshfs_server process via procfs, which are conditions that may be hard to meet in a supervised environment but present a significant threat if an attacker gains root in a virtual machine. The EPSS score is currently unavailable, and the issue has not been listed in the CISA KEV catalog. Nonetheless, the high severity and the potential to read any host file make it a dangerous vector for data disclosure and privilege escalation.