{"id":"CVE-2026-58494","kind":"vulnerability","aliases":["CVE-2026-58494","GHSA-4ch3-9j33-3pmj"],"related":[],"title":"Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination","description":"## Summary\n\nWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass `WasiCtxBuilder` per-preopen `FilePerms` and modify host files that were exposed as `FilePerms::READ`.\n\nThis attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem.\n\nThis attack is also possible through an indirection of renaming a hardlink into another preopen.\n\n### Details\n\n`WasiCtxBuilder::preopened_dir` documents `file_perms` as the maximum permissions usable for files in that preopen. However, hard-link creation and renaming only checked directory mutation for permission, and not whether the file permissions matched.\n\nThis makes an attack possible where:\n* a read-only file `target` exists in a preopen with only FilePerms::READ\n* a hardlink named `alias`, with destination to the `target`, is created in a preopen with FilePerms::READ | FilePerms::WRITE\n* the attacker opens the file `alias` for writing, in which they can overwrite `target`\n\nThe same attack is possible by way of renaming:\n* a read-only file `target` exists in a preopen with only FilePerms::READ\n* a hardlink named `alias`, with destination to the `target`, is created in that same preopen\n* the `alias` file is renamed into a preopen with FilePerms::READ | FilePerms::WRITE\n* the attacker opens the file `alias` for writing, in which they can overwrite `target`\n\nSymbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors.\n\n### Remediation\n\nThe definition of `Dir::link_at` and `Dir::rename_at` in wasmtime-wasi's `src/filesystem.rs` now have an additional permissions check that ensures the source and destination values for the directory permissions `perms` and the file permissions `file_perms` are identical.\n\n```rust\n        if self.perms != new_dir.perms || self.file_perms != new_dir.file_perms {\n            return Err(ErrorCode::NotPermitted);\n        }\n```\n\n### Impact\n\nOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder:\n\n```rust\nbuilder.preopened_dir(\"readwrite\", \"readwrite\", DirPerms::READ | DirPerms::MUTATE, FilePerms::READ | FilePerms::WRITE);\nbuilder.preopened_dir(\"readonly\", \"readonly\", DirPerms::READ | DirPerms::MUTATE, FilePerms::READ);\n```\n\nIn particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens.","summary":"Wasmtime's wasmtime-wasi lets a WASI guest create a hard link to a read-only file in a preopen that allows writes, then write through that link to overwrite the host file. An attacker who controls a WASI guest can modify host files that were exposed as FilePerms::READ.","severity":"medium","cvss":6.5,"epss":0.0017099999822676182,"exploited":false,"exploited_at":null,"products":[{"name":"wasmtime-wasi","fixed":["24.0.11"],"affected":"< 24.0.11","ecosystem":"cargo"},{"name":"wasmtime-wasi","fixed":["36.0.12"],"affected":">= 25.0.0, < 36.0.12","ecosystem":"cargo"},{"name":"wasmtime-wasi","fixed":["45.0.3"],"affected":">= 37.0.0, < 45.0.3","ecosystem":"cargo"},{"name":"wasmtime-wasi","fixed":["46.0.1"],"affected":">= 46.0.0, < 46.0.1","ecosystem":"cargo"}],"ecosystems":["cargo"],"tags":["cwe-281","cwe-863","embedders","package","rust","wasi","wasmtime"],"not_affected_if":["no-dirperms-mutate","no-fileperms-read-only-preopen","single-preopen-config","wasmtime-cli-only"],"how_to_check":"Search embedding code for WasiCtxBuilder::preopened_dir calls that combine DirPerms::MUTATE with FilePerms::READ on one preopen and FilePerms::READ | FilePerms::WRITE on another.\nCheck the wasmtime-wasi version in Cargo.lock against the affected ranges.\nwasmtime-cli is not affected because it always sets FilePerms::all().","fix":"Upgrade wasmtime-wasi to 24.0.11, 36.0.12, 45.0.3, or 46.0.1 depending on your release line.\nIf you cannot upgrade, do not give a guest a read-only file preopen alongside a writable preopen that shares the same mutable directory setup.","status":"open","published_at":"2026-07-08T21:16:54+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T19:57:47+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T19:57:47Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade wasmtime-wasi to 24.0.11, 36.0.12, 45.0.3, or 46.0.1 depending on your release line.\nIf you cannot upgrade, do not give a guest a read-only file preopen alongside a writable preopen that shares the same mutable directory setup.","summary":"Wasmtime's wasmtime-wasi lets a WASI guest create a hard link to a read-only file in a preopen that allows writes, then write through that link to overwrite the host file. An attacker who controls a WASI guest can modify host files that were exposed as FilePerms::READ.","category":"package","who_cares":["wasmtime","rust","wasi","embedders"],"confidence":0.85,"analyst_note":"","how_to_check":"Search embedding code for WasiCtxBuilder::preopened_dir calls that combine DirPerms::MUTATE with FilePerms::READ on one preopen and FilePerms::READ | FilePerms::WRITE on another.\nCheck the wasmtime-wasi version in Cargo.lock against the affected ranges.\nwasmtime-cli is not affected because it always sets FilePerms::all().","needs_analyst":false,"not_affected_if":["wasmtime-cli-only","single-preopen-config","no-DirPerms-MUTATE","no-FilePerms-READ-only-preopen"],"severity_if_unknown":"unknown"},"cost_usd":0.000561,"input_tokens":3200,"output_tokens":482,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,22A '-281':37B '-58494':15A,23A '-863':39B '3pmj':20A '4ch3':18A '9j33':19A 'addit':424C 'affect':490C,541C 'alia':244C,265C,300C,313C,330C 'allow':68B,126C 'alreadi':354C 'also':172C 'alway':544C 'anoth':123C,182C 'attack':81B,130C,155C,170C,224C,261C,276C,326C,347C,378C 'believ':370C 'borrow':390C 'bug':493C 'builder.preopened':502C,514C 'bypass':5A,138C 'capabl':113C 'check':209C,426C 'cli':532C 'combin':468C 'control':83B 'creat':54B,251C,307C 'creation':205C 'cve':13A,21A 'cwe':36B,38B 'definit':406C 'descriptor':393C,403C 'destin':12A,246C,302C,358C,400C,432C 'detail':184C 'differ':402C 'dir':187C,408C,412C,503C,515C 'directori':210C,436C 'dirperm':470C,506C,508C,518C,520C 'document':188C 'e.g':396C,494C 'embed':464C 'embedd':40B 'enforc':355C 'ensur':428C 'err':456C 'errorcod':457C 'exist':233C,289C 'expos':93B,150C 'file':63B,79B,90B,112C,116C,127C,147C,189C,197C,218C,231C,264C,287C,314C,329C,441C,443C 'fileperm':10A,95B,143C,152C,239C,256C,258C,295C,321C,323C,473C,485C,510C,512C,522C,546C 'filesystem':101C,168C,352C,385C 'ghsa':17A 'ghsa-4ch3-9j33-3pmj':16A 'guest':53B,86B,105C,136C 'hard':3A,56B,119C,203C 'hard-link':118C,202C 'hardlink':180C,242C,298C 'higher':483C 'host':78B,89B,146C 'howev':201C 'ident':446C 'impact':459C 'implement':102C 'indirect':176C 'interfac':164C,353C,386C 'let':50B,103C 'link':4A,57B,74B,120C,204C,340C,409C 'make':222C 'match':220C 'maximum':193C 'modifi':88B,145C 'multipl':389C 'mutat':211C,471C,509C,521C 'name':243C,299C 'new_dir.file':453C 'new_dir.perms':450C 'notpermit':458C 'open':262C,327C 'overwrit':76B,114C,272C,337C 'packag':41B 'particular':525C 'per':141C 'per-preopen':140C 'perm':190C,438C,444C,452C,454C 'permiss':194C,213C,219C,425C,437C,442C,484C 'possibl':157C,173C,225C,278C 'preopen':66B,124C,142C,183C,186C,200C,236C,254C,292C,311C,319C,366C,481C,550C 'project':528C 'read':61B,96B,109C,153C,229C,240C,257C,285C,296C,322C,474C,507C,511C,519C,523C 'read-on':60B,108C,228C,284C 'readon':516C,517C 'readwrit':504C,505C 'remedi':404C 'renam':178C,207C,282C,316C,413C 'resourc':394C 'return':455C 'run':133C 'rust':42B,447C,501C 'second':480C 'self.file':451C 'self.perms':449C 'set':545C 'sourc':111C,398C,430C 'src/filesystem.rs':420C 'summari':97C 'symbol':339C 'symlink':361C 'take':388C 'target':232C,249C,273C,288C,305C,338C 'usabl':195C 'use':466C,478C,497C,534C 'valu':433C 'vector':344C,375C 'wasi':2A,8A,26A,29A,32A,35A,43B,49B,52B,85B,100C,135C,167C,351C,384C,418C,463C,538C 'wasi-filesystem':350C 'wasictxbuild':139C,185C,500C 'wasip1':160C 'wasip2':161C 'wasip3':163C 'wasmtim':1A,7A,44B,45B,48B,98C,417C,462C,527C,531C,537C 'wasmtime':25A,28A,31A,34A 'wasmtime-c':530C 'wasmtime-wasi':6A,24A,27A,30A,33A,47B,416C,461C,536C 'way':280C 'well':476C,488C 'whether':216C 'write':69B,71B,128C,259C,267C,324C,332C,486C,513C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-08T21:16:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4ch3-9j33-3pmj","url":"https://github.com/advisories/GHSA-4ch3-9j33-3pmj","severity":"medium","published_at":"2026-10-16T19:57:26+00:00","modified_at":"2026-10-16T19:57:30+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-58494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58494","severity":null,"published_at":"2026-07-08T21:16:54+00:00","modified_at":"2026-07-10T19:10:59+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}