CVE-2026-116213 in Webasyst
Summary
by MITRE • 10/26/2026
Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The Webasyst framework, specifically versions up to 4.4.0, contains a critical arbitrary file read vulnerability within its archive handling functionality. This flaw resides in the waArchiveTar::writeItem() method, which is responsible for processing and extracting files from theme archives uploaded by users. The core technical deficiency lies in the failure to validate or sanitize symbolic link targets during the extraction process. When an administrator with theme management privileges uploads a maliciously crafted archive containing symlinks, the system processes these links without verifying that they point only within allowed directories. This lack of path traversal validation allows attackers to construct archives where symbolic links target sensitive files outside the intended web root or application directory structure.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The attacker exploits the trust placed in authenticated users who have permission to manage themes by uploading an archive that includes symbolic links pointing to critical system files such as wa-config/db.php or /etc/passwd. Because Webasyst serves theme assets through a public-facing URL path, any file successfully extracted into the theme directory becomes accessible via HTTP requests. Consequently, even though the initial action requires authentication and specific privileges, the resulting state allows for unauthorized reading of sensitive configuration data and system files that should remain inaccessible to web users or lower-privileged accounts.
The operational impact of this vulnerability is severe, particularly in environments where database credentials are stored within theme configurations or where local file inclusion could lead to further exploitation vectors. By accessing wa-config/db.php, an attacker can potentially retrieve database connection strings containing usernames and passwords, which may be reused across other systems if credential hygiene practices are poor. Similarly, reading /etc/passwd provides information about user accounts on the hosting server, aiding in subsequent reconnaissance or privilege escalation attempts. This vulnerability effectively bypasses standard access controls by leveraging the application's own file serving mechanism to expose internal resources that were never intended for public consumption.
Mitigation strategies should focus primarily on upgrading to a patched version of Webasyst where this issue has been addressed through improved input validation and path canonicalization before extraction. In cases where immediate patching is not feasible, administrators can implement defensive measures such as restricting file upload types at the web server level, ensuring that symbolic link creation is disabled during archive extraction processes via custom code overrides if possible, or isolating theme directories with strict filesystem permissions to prevent access to parent directory contents. Additionally, monitoring for unusual patterns in uploaded archives and auditing user activities related to theme management can help detect exploitation attempts early. Organizations should also review their deployment configurations to ensure that sensitive configuration files are not stored within accessible web roots unless absolutely necessary, adhering to the principle of least privilege and secure default configurations as recommended by industry standards like OWASP.