MEDIUMCVSS v3.1 4.9Vulnerability
CVE-2026-116213
Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-26T15:09:35.071340+00:00
- Cvss score
- 4.9
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-10-26T15:13:41+00:00
- Score
- 4.9
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-116213
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- First seen by Signal
- 2026-10-26T15:13:41+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Published at
- 2026-10-26T14:16:34.020
- Last modified
- 2026-10-26T14:16:34.020
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph