cyfenced.com →

[ CVE-2026-58494 · Published 8 Jul 2026 ]

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

CVSS 6.5 EPSS <1%Fix available

[ Description ]Official description

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.

[ Fixes ]Fixes and patches

  • wasmtime-wasi 24.0.11Fixed version · GitHub Advisories · rust package wasmtime-wasi: upgrade to 24.0.11 or later (affected < 24.0.11)
  • wasmtime-wasi 36.0.12Fixed version · GitHub Advisories · rust package wasmtime-wasi: upgrade to 36.0.12 or later (affected >= 25.0.0, < 36.0.12)
  • wasmtime-wasi 45.0.3Fixed version · GitHub Advisories · rust package wasmtime-wasi: upgrade to 45.0.3 or later (affected >= 37.0.0, < 45.0.3)
  • wasmtime-wasi 46.0.1Fixed version · GitHub Advisories · rust package wasmtime-wasi: upgrade to 46.0.1 or later (affected >= 46.0.0, < 46.0.1)

[ Packages ]Affected open-source packages

[ References ]References