CVE-2026-58494

The record

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.

Affected packages

Related vulnerabilities

• CVE-2026-61709 OpenFGA is an authorization and permission engine built for developers. CWE-281
• CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code… CWE-281
• CVE-2026-23556 When oxenstored is tearing a domain down, the node data is cleaned up but the usage… CWE-281
• CVE-2026-4360 In the Tarfile.extract() function, the filter parameter is not passed properly when… CWE-281
• CVE-2026-40767 Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions. CWE-281
• CVE-2024-47270 Improper preservation of permissions vulnerability in Archiving Push functionality in… CWE-281
• CVE-2026-44832 Snipe-IT is an IT asset/license management system. CWE-281
• CVE-2026-24194 NVIDIA Display Driver for Linux contains a vulnerability in a kernel mode layer handler… CWE-281