{"id":"EUVD-2026-42393","revision":"3637ef9b7c8348ee9c9331bc91fd12fe","records":[{"revision":"3637ef9b7c8348ee9c9331bc91fd12fe","observedAt":"2026-11-07T13:24:27.402+00:00","statement":{"source":"euvd","id":"EUVD-2026-42393","aliases":["CVE-2026-58494","GHSA-4ch3-9j33-3pmj"],"title":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI g…","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","score":6.5,"severity":null}],"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj","https://github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c","https://github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367","https://github.com/bytecodealliance/wasmtime/commit/8a250aac0962ca1364b5f16525720e9d0b39edcd","https://github.com/bytecodealliance/wasmtime/commit/d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9e","https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.11","https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.12","https://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.3","https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42393","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 8, 2026, 8:22:16 PM","dateUpdated":"Jul 9, 2026, 1:28:57 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42393","identifiers":["EUVD-2026-42393","CVE-2026-58494","GHSA-4ch3-9j33-3pmj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}