CVE-2026-116213mediumCWE-59

CVE-2026-116213: falha de média gravidade em Webasyst Framework

Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks

Publicada em

Seguir esta CVE+ Monitorar Webasyst Framework

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.4%
Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Webasyst · Webasyst Framework
CVEs relacionadas — Webasyst Framework

No mesmo produto, das mais perigosas para as menos.

CVE-2026-116210HIGHWebasyst Framework through 4.4.0 Photos App CSRF via Backend ActionsEPSS 0.2%CVE-2026-116212MEDIUMWebasyst Framework through 4.4.0 Stored XSS via Photos Album URLEPSS 0.2%