FreeBSD Security Advisory – Due to the lack of handling of potential symbolic links the host’s jail rc.d(8) script is vulnerable to “symlink attacks”. By replacing /var/log/console.log inside the jail with a symbolic link it is possible for the superuser (root) inside the jail to overwrite files on the host system outside the jail with arbitrary content. This in turn can be used to execute arbitrary commands with non-jailed superuser privileges.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/58298/FreeBSD-SA-07-01.jail.txt
Source: https://packetstormsecurity.com/files/58298/FreeBSD-SA-07-01.jail.txt.html