Webasyst Framework
Monthly
Cross-site request forgery in the Webasyst Framework Photos app through 4.4.0 allows a malicious page to submit forged POST requests as a logged-in backend user, deleting photos and changing access rights. The Photos app does not enable the framework's opt-in CSRF check, and exploitation requires the victim to hold an active authenticated session and to be induced into loading the attacker's page; the attacker needs no privileges of their own (PR:N), but the victim interaction prevents unattended mass exploitation. Impact is confined to the photo/delete, album/save, photo/manageAccessSave and photo/saveField endpoints with high integrity impact and no confidentiality or system-level effect; this is a moderate, not emergency, priority and no public exploit was identified at time of analysis.
Authenticated users holding theme management rights on Webasyst Framework through 4.4.0 can read arbitrary files from the server by uploading a crafted theme archive containing symlinks, because waArchiveTar::writeItem() recreates those links without validating their targets and the linked file is then retrievable through the public theme path. Successful abuse exposes secrets such as wa-config/db.php or system files like /etc/passwd. The flaw is gated behind a high-privilege administrative capability (CVSS 3.1 PR:H, 6.9; CWE-59), so realistic attackers are malicious insiders or intruders who already control a privileged account; no public exploit code was identified at time of analysis, and this is tracked as a this-month priority rather than an emergency.
Stored cross-site scripting in the Webasyst Framework Photos app (through 4.4.0) allows an authenticated backend user with album edit rights to save a crafted 'url' value that executes JavaScript in an administrator's backend session when the album settings dialog is opened. The issue is rated 5.1 (medium) and requires victim interaction; it is not remotely exploitable without a backend account and album-edit permission. No CISA KEV entry was identified and no public exploit identified at time of analysis, and the available data does not list a fixed version.
Cross-site request forgery in the Webasyst Framework Photos app through 4.4.0 allows a malicious page to submit forged POST requests as a logged-in backend user, deleting photos and changing access rights. The Photos app does not enable the framework's opt-in CSRF check, and exploitation requires the victim to hold an active authenticated session and to be induced into loading the attacker's page; the attacker needs no privileges of their own (PR:N), but the victim interaction prevents unattended mass exploitation. Impact is confined to the photo/delete, album/save, photo/manageAccessSave and photo/saveField endpoints with high integrity impact and no confidentiality or system-level effect; this is a moderate, not emergency, priority and no public exploit was identified at time of analysis.
Authenticated users holding theme management rights on Webasyst Framework through 4.4.0 can read arbitrary files from the server by uploading a crafted theme archive containing symlinks, because waArchiveTar::writeItem() recreates those links without validating their targets and the linked file is then retrievable through the public theme path. Successful abuse exposes secrets such as wa-config/db.php or system files like /etc/passwd. The flaw is gated behind a high-privilege administrative capability (CVSS 3.1 PR:H, 6.9; CWE-59), so realistic attackers are malicious insiders or intruders who already control a privileged account; no public exploit code was identified at time of analysis, and this is tracked as a this-month priority rather than an emergency.
Stored cross-site scripting in the Webasyst Framework Photos app (through 4.4.0) allows an authenticated backend user with album edit rights to save a crafted 'url' value that executes JavaScript in an administrator's backend session when the album settings dialog is opened. The issue is rated 5.1 (medium) and requires victim interaction; it is not remotely exploitable without a backend account and album-edit permission. No CISA KEV entry was identified and no public exploit identified at time of analysis, and the available data does not list a fixed version.