What is CVE-2026-116213?

CVE-2026-116213 is a medium-severity vulnerability in Webasyst Framework, classified under Improper Link Resolution Before File Access. CVSS score: 4.9/10. Published 2026-10-26.

How severe is CVE-2026-116213?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Vulnerability in Webasyst Framework

CVE-2026-116213

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.

Published 2026-10-26 · last modified 2026-10-26.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Webasyst Framework

Weakness classification (CWE)

CWE-59 — Improper Link Resolution Before File Access

References

github.com/webasyst/webasyst-framework/issues/396 (issue-tracking)
github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120… (technical-description)
github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120… (technical-description)
github.com/webasyst/webasyst-framework (product)
www.vulncheck.com/advisories/webasyst-framework-through-4.4.0-arbitrary-file-re… (third-party-advisory)

Frequently asked questions

What is CVE-2026-116213?: CVE-2026-116213 is a medium-severity vulnerability in Webasyst Framework, classified under Improper Link Resolution Before File Access. CVSS score: 4.9/10. Published 2026-10-26.
How severe is CVE-2026-116213?: Medium severity. CVSS v3 base score is 4.9 out of 10.