CVE-2026-58494CWE-281CWE-863

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

Medium · published July 8, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00171 · 6.2th percentile
Weaknesses
CWE-281 · Improper Preservation of Permissions; CWE-863 · Incorrect Authorization
Published
2026-07-08T20:22Z
EPSS history
Timeline
  • 08 JUL 20:22Z
    Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
    cvelistv5