CVE-2026-58494 Details

A vulnerability exists in the Wasmtime WebAssembly runtime, specifically within the wasmtime-wasi component, prior to versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1. The issue arises because the hard-link creation and renaming functions do not properly verify directory permissions against the file permissions of the source and destination preopens. This oversight allows a WASI guest with read-only access to a file to overwrite host files that are exposed with read permissions through the wasip1, wasip2, or wasip3 filesystem interfaces. The vulnerability can be exploited by creating a hard link to a read-only file in a writable directory or by renaming a hard link across different permission domains, effectively bypassing the intended file permission restrictions.

Users can update to Wasmtime versions 24.0.11, 36.0.12, 45.0.3, or 46.0.1, where this vulnerability has been fixed.