Is CVE-2026-116213 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116213?

CVE-2026-116213 has a CVSS v3 severity of MEDIUM (4.9).

Back

CVE-2026-116213

Description

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.