CVE-2026-58494
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- EPSS probability
- 0.17%
- CWE
- CWE-281, CWE-863
- Published
- 2026-07-08
- Last modified
- 2026-07-09
Affected products
- bytecodealliance wasmtime
- bytecodealliance wasmtime
- bytecodealliance wasmtime
- bytecodealliance wasmtime
Weakness type
Related vulnerabilities
- CVE-2026-88016 — rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
- CVE-2026-58510 — GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
- CVE-2025-14779 — Improper Access Control via Secret Type Management API in WSO2 Identity Server
- CVE-2026-23556 — oxenstored keeps quota related use counts across domain destruction
- CVE-2026-4360 — Tarfile.extract() doesn't fully respect filter parameter
- CVE-2026-44947 — Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher
- CVE-2026-40767 — WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability
- CVE-2024-47270 — Improper preservation of permissions vulnerability in Archiving Push functionality in Synology...