Threats tagged 'ghsa-ggmg-wv8x-pc69'

Webasyst Framework versions through 4.4.0 have an arbitrary file read vulnerability in the waArchiveTar::writeItem() function. This flaw allows authenticated users with theme management rights to upload theme archives containing symbolic links that point to sensitive files such as wa-config/db.php or /etc/passwd. These files can then be read through the public theme path, potentially exposing sensitive configuration or system information.