Live › vulnerability › CVE-2026-116213
Go to dashboardWebasyst Framework through 4.4.0 extracts theme archives and creates symlinks without checking where they point. A user with theme management rights can upload a theme containing a symlink to files such as wa-config/db.php or /etc/passwd and read them through the public theme path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Installations of Webasyst Framework up to and including 4.4.0 where users hold theme management rights can be exposed. Sites that restrict theme management to fully trusted administrators, or that run a newer release, are less exposed. unknown whether a specific patched version exists in the sources.
No product ranges from the sources yet.
4.4.0 in the installation's version file or the admin dashboard.find <webasyst-root>/wa-data -type l and inspect any link targets pointing outside the theme.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.
This page as .md · .json · in your agent: get_signal("CVE-2026-116213")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.