CVE-2026-58494
published 2026-07-08CVE-2026-58494: Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions…
PriorityP432medium6.5CVSS 3.1
AVLACLPRLUINSCCNIHAN
EPSS
0.17%
6.6th percentile
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bytecodealliance | wasmtime | < 24.0.11 | 24.0.11 |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | — | — |
| rhcl-1 | wasm-shim-rhel9 | — | — |
| rust-lang | rust | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
wasmtime: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi
vendor_redhat·2026-07-08·CVSS 6.5
CVE-2026-58494 [MEDIUM] CWE-280 wasmtime: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi
wasmtime: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.
A flaw was found in Wasmtime, a runtime for WebAssembly. A WebAssembly System Interface (WASI) guest with a read-only source file capability can exploit this vulnerability. During hard-link creation and renaming operations, the system checks
VulDB
bytecodealliance wasmtime up to 24.0.10/36.0.11/45.0.2/46.0.0 Filesystem Interface permission
vuldb·2026-07-08·CVSS 6.5
CVE-2026-58494 [MEDIUM] bytecodealliance wasmtime up to 24.0.10/36.0.11/45.0.2/46.0.0 Filesystem Interface permission
A vulnerability was found in bytecodealliance wasmtime up to 24.0.10/36.0.11/45.0.2/46.0.0. It has been classified as problematic. This affects an unknown function of the component Filesystem Interface. This manipulation causes permission issues.
This vulnerability is handled as CVE-2026-58494. The attack can be initiated remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58494 tree-sitter: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi [fedora-all]
bugzilla·2026-07-09·CVSS 6.5
CVE-2026-58494 [MEDIUM] CVE-2026-58494 tree-sitter: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi [fedora-all]
CVE-2026-58494 tree-sitter: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3,
Bugzilla
CVE-2026-58494 tree-sitter0.25: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi [fedora-all]
bugzilla·2026-07-09·CVSS 6.5
CVE-2026-58494 [MEDIUM] CVE-2026-58494 tree-sitter0.25: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi [fedora-all]
CVE-2026-58494 tree-sitter0.25: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.
Bugzilla
CVE-2026-58494 wasmtime: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi
bugzilla·2026-07-08·CVSS 6.5
CVE-2026-58494 [MEDIUM] CVE-2026-58494 wasmtime: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi
CVE-2026-58494 wasmtime: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.
https://github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0chttps://github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367https://github.com/bytecodealliance/wasmtime/commit/8a250aac0962ca1364b5f16525720e9d0b39edcdhttps://github.com/bytecodealliance/wasmtime/commit/d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9ehttps://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.11https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.12https://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.3https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.1https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj
2026-07-08
Published