Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks

Webasyst Framework · Link following · CWE-59

AffectedWebasyst Framework

FixNo fix listed yet.

PublishedOct 26, 13:08 · VulnCheck

ScoredOct 26 · 4.9 · VulnCheck

Exploit code publicNone known · checked 22:18 UTC

ExploitedNone known · CISA KEV checked 22:30 UTC

What we know

No known exploitation. CISA KEV, checked 22:30 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.

An attacker needs network access and an account. CVSS: network, high privileges.

A successful attack can read data. CVSS impact.

Description

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.

From VulnCheck

Affected and fixed versions

ProductAffectedFixed inWebasyst Frameworkup to 4.4.0–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

GitHub Issue #396 · github.comissue tracking github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-system/file/waArchiveTar.class.php#L1243-L1250 · github.comtechnical description github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-system/file/waTheme.class.php#L2609-L2660 · github.comtechnical description github.com/webasyst/webasyst-framework · github.comproduct VulnCheck Advisory: Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks · vulncheck.comthird party advisory

Other CVEs in Webasyst Framework

All 2 →

5.4Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL · CVE-2026-116212Oct 26 6.5Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions · CVE-2026-116210Oct 26