CVE-2026-116213: Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks

Q: Which users could exploit this issue?

An attacker must be authenticated and have theme management rights. Unauthenticated users are not described as being able to upload the malicious theme archive themselves.

Q: What access can an attacker obtain?

A malicious theme archive can contain symlinks to files such as wa-config/db.php or /etc/passwd. If the linked file is readable by the application and exposed through the public theme path, the attacker can read its contents.

Q: Which installations should be considered potentially affected?

Webasyst Framework versions through 4.4.0 are affected according to the available information. Prioritize installations where users have theme management permissions and uploaded theme files are publicly accessible.

Published Oct 26, 2026

Updated

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.

Affected Software

1 affected component

Webasyst Framework<=4.4.0

Event History

Oct 26, 2026

CVE Published

via MITRE·01:08 PM

Data Sourced

via MITRE·01:08 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users could exploit this issue?

An attacker must be authenticated and have theme management rights. Unauthenticated users are not described as being able to upload the malicious theme archive themselves.

What access can an attacker obtain?

A malicious theme archive can contain symlinks to files such as wa-config/db.php or /etc/passwd. If the linked file is readable by the application and exposed through the public theme path, the attacker can read its contents.

Which installations should be considered potentially affected?

Webasyst Framework versions through 4.4.0 are affected according to the available information. Prioritize installations where users have theme management permissions and uploaded theme files are publicly accessible.

CVE-2026-116213: Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks

Affected Software

Event History

Frequently Asked Questions

Which users could exploit this issue?

What access can an attacker obtain?

Which installations should be considered potentially affected?

Company

Resources

Contact

Frequently Asked Questions

Which users could exploit this issue?

What access can an attacker obtain?

Which installations should be considered potentially affected?