Webasyst Framework CVE-2026-116213

Requires an authenticated account possessing Webasyst theme management rights and the ability to upload a theme archive - this is a privileged/administrative capability, not available to anonymous or low-privileged users. The concrete trigger is a theme .tar archive containing a symlink whose target is a sensitive file (e.g. wa-config/db.php or /etc/passwd); waArchiveTar::writeItem() recreates the symlink without validating its target, and the file is then read via the public theme path. Limiting factors: exploitation is gated on that high-privilege theme-management role, so realistic threat actors are malicious insiders or attackers who have already compromised a privileged account; affected versions are Webasyst Framework through 4.4.0.

This is a genuine but constrained risk, not an internet-facing emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H) scores 6.9 (medium) and the key gating factor is PR:H: exploitation requires an authenticated account that already holds theme management rights, which is an administrative/trusted role. Impact is confidentiality-only (VC:H, VI:N/VA:N) - arbitrary file read, not code execution or data modification. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-prioritizable issue. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided, so there is no signal of active or widespread exploitation; the reporting is a VulnCheck advisory plus the upstream GitHub issue. In short, the signals are internally consistent: high technical impact on confidentiality offset by a high-privilege precondition, pointing to an insider/compromised-admin threat model rather than mass remote exploitation. Missing data to note explicitly: EPSS is absent (cannot gauge exploitation probability) and there is no independently confirmed working exploit.

An authenticated user (or an attacker who has compromised such an account) with Webasyst theme management rights crafts a malicious theme archive containing a symlink pointing at a sensitive file such as wa-config/db.php or /etc/passwd. When the theme is uploaded and unpacked, waArchiveTar::writeItem() recreates the symlink without validating its target, and the attacker then fetches the symlinked content over the public theme path to read the file. No public exploit code was identified at time of analysis, though the upstream GitHub issue describes the technique.