CVE-2026-58494: Wasmtime WASI FilePerms Bypass Allows Read-Only File Overwrite

Technical summary

The vulnerability resides in wasmtime-wasi's handling of filesystem operations across WASI sandboxing boundaries. When a WASI guest initiates hard-link creation or file renaming, the runtime validates directory-level permissions but fails to cross-check FilePerms attributes on both source and destination preopened directories. This permits a guest with read-only FilePerms on a source file to create a hard link to or rename a destination file with different (potentially write-enabled) permissions, effectively circumventing the intended capability model. The flaw affects wasip1, wasip2, and wasip3 interface variants. The root cause involves CWE-281 (Improper Preservation of Permissions) and CWE-863 (Incorrect Authorization), allowing privilege escalation within the sandbox-to-host boundary.

Business impact

Organizations using Wasmtime to execute untrusted or semi-trusted WebAssembly code face a containment breach. A malicious or compromised wasm guest can write to host-exposed files that should be read-only, potentially corrupting application data, modifying configuration files, injecting malicious code into host processes, or triggering denial of service. The risk is amplified in multi-tenant environments, containerized deployments, or edge-computing platforms where wasm modules are dynamically loaded. Affected users may need to audit logs for unauthorized file modifications, revoke trust in previously executed modules, and validate data integrity.

Affected systems

Wasmtime versions prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1 are affected. All supported release branches through version 46 contain the vulnerability until the respective patch is applied. This includes production deployments and development environments relying on wasmtime-wasi for WASI interface provisioning. Organizations using older versions or custom forks must prioritize assessment and patching.

Exploitability

Exploitation requires local access to the system running Wasmtime and the ability to execute or influence the wasm bytecode loaded into the runtime. The attack is not remotely triggerable by itself, though a compromised or malicious wasm module loaded over the network could exploit the flaw. No user interaction is required; a WASI guest with low privileges can trigger the exploit. The vulnerability is straightforward to exploit once bytecode execution is achieved, making remediation urgent for deployments that load wasm from untrusted sources or in environments where module provenance is uncertain.

Remediation

Upgrade to Wasmtime version 24.0.11, 36.0.12, 45.0.3, or 46.0.1 or later, depending on your release branch. The patches implement proper FilePerms matching validation during hard-link and rename operations, ensuring that source and destination permissions are checked before the operation proceeds. After patching, reload or restart Wasmtime-dependent services. No configuration changes are required. For teams unable to upgrade immediately, restrict the capabilities and filesystem permissions granted to untrusted wasm guests and avoid exposing sensitive host files through WASI preopen directories.

Patch guidance

Coordinate upgrades to the minimum patched versions for your branch: 24.x users should update to 24.0.11 or later; 36.x users to 36.0.12 or later; 45.x users to 45.0.3 or later; and 46.x users to 46.0.1 or later. Verify the patch version in release notes before deployment. Test upgrades in a staging environment, particularly if you use custom WASI configurations or sandboxing policies. Ensure dependent tools and integrations (e.g., Docker images, Kubernetes controllers) also pull the updated Wasmtime runtime.

Detection guidance

Monitor for anomalous hard-link or rename operations initiated by wasm guest code, particularly those crossing preopen directory boundaries with differing FilePerms. Log WASI filesystem syscall sequences and correlate read-only file handles with subsequent write operations. Examine audit trails for unauthorized modifications to host files marked as read-only. Inspect running Wasmtime instances for outdated version strings and review loaded wasm module origins. Runtime instrumentation or custom WASI hooks can detect permission violations at the syscall boundary.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the vulnerability enables direct containment bypass in sandboxed environments, allowing guest code to corrupt or manipulate host files. The impact on data integrity and system configuration is high, and remediation is straightforward. Organizations relying on Wasmtime for untrusted workload isolation should treat this as HIGH priority. Low-attack-surface deployments (e.g., trusted wasm modules only) can be lower priority but should still be patched.

Risk score, explained

CVSS 6.5 reflects local-access requirement (AV:L), low attack complexity (AC:L), low privileges needed (PR:L), and scope change (S:C) due to sandbox boundary crossing. Integrity impact is high (I:H), but confidentiality and availability are not directly affected. The score does not fully capture the containment-breaking nature of the flaw; in high-stakes sandboxing scenarios, practical risk may exceed the numeric severity.

Frequently asked questions