CVE-2026-116213
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.
Risk Assessment
An attacker with theme management rights can read sensitive configuration files, such as database credentials, potentially leading to further system compromise.
Recommendation
Update Webasyst Framework to a version later than 4.4.0 that fixes this vulnerability, and restrict theme management rights to trusted users only.
Other vulnerabilities in Webasyst Framework
See all- CVE-2026-116212Medium
Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.
- CVE-2026-116210Medium
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.
- CVE-2026-51954High
An issue in Webasyst Framework 4.0.3 and earlier allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.
Original NVD description (English source)
Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS