Executive brief
Craft CMS contains a theoretical path traversal vulnerability in its local file system handling that could allow attackers to read files outside the intended storage volume directory. While the vendor confirms no working exploit has been discovered and the issue is not directly exploitable, the flaw exists due to improper validation order and is being patched for defense-in-depth hardening. Organizations running affected versions should update to the patched releases.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the ensurePathIsContained function of Craft CMS's Local file system class. The root cause is a desanitization-style issue: the code validates file paths before normalizing them, allowing normalization to invalidate the assumptions made by prior validation. When the file stream is requested via getFileStream, the path construction sequence (validate → normalize → prefix) creates an opportunity for a normalized path to escape the intended volume directory boundary. Attack vectors are limited to local file system operations where an attacker can influence path inputs. The vendor explicitly notes no exploitable scenario has been discovered; the issue is theoretical and patched for hardening purposes rather than to address active exploitation.
Affected products
- Craft CMS Craft CMS >=4.0.0-RC1, <4.18.2 and >=5.0.0-RC1, <5.10.6
Timeline
- 2026-07-25: disclosed: Original advisory published (GHSA-7hxc-f267-h5q7)
- 2026-08-11: disclosed: Duplicate advisory published (GHSA-9w6w-8x3c-hfqp)
- 2026-08-11: patched: Patches released: Craft CMS 4.18.2 and 5.10.6
- 2026-09-01: other: Duplicate advisory withdrawn