Webasyst Framework versions through 4.4.0 are vulnerable to an arbitrary file read flaw in the waArchiveTar::writeItem() method. When a theme archive is uploaded, the method creates symbolic links without validating their targets, allowing an attacker with theme‑management privileges to reference internal files such as wa-config/db.php or the host's /etc/passwd. By requesting the linked files through the public theme path, the attacker can read arbitrary contents, breaching the confidentiality of configuration and system files. The weakness is a path‑traversal style flaw (CWE‑59).

Affected vendor is Webasyst, product Webasyst Framework, any release up to and including version 4.4.0. Users deploying a custom theme or third‑party theme packages on these versions are at risk. The issue is triggered only for authenticated users with the role that permits theme management.

The CVSS score of 6.9 signals a moderate severity. Because no EPSS score is published, the predicted exploitation probability remains uncertain, and the vulnerability is not currently listed in CISA's KEV catalog. Based on the description, the likely attack vector would be remote—an attacker must first gain the ability to upload a malformed theme archive, which requires legitimate credentials with theme‑management rights. Once a privileged upload is performed, the attacker can directly read targeted files via the public URL, exploiting the symlink creation feature. The flaw does not require additional environmental conditions beyond the stated authentication level.