Craft CMS path traversal in ensurePathIsContained

Severity: medium · CVSS 6.2 · Published 2026-08-11

Craft CMS contains a theoretical path traversal vulnerability in its local file system handling that could allow attackers to read files outside the intended storage volume directory. While the vendor confirms no working exploit has been discovered and the issue is not directly exploitable, the flaw exists due to improper validation order and is being patched for defense-in-depth hardening. Organizations running affected versions should update to the patched releases.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.2, published 11 August 2026.
Which products and versions are affected?
craftcms/cms (Packagist) >= 4.0.0-RC1, < 4.18.2.
Is there a fix for This vulnerability?
A patch was published on 2026-08-11: Patches released: Craft CMS 4.18.2 and 5.10.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked with local access, in a web application.
Am I affected?
Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal flaw (CWE-22) in the ensurePathIsContained function of Craft CMS's Local file system class. The root cause is a desanitization-style issue: the code validates file paths before normalizing them, allowing normalization to invalidate the assumptions made by prior validation. When the file stream is requested via getFileStream, the path construction sequence (validate → normalize → prefix) creates an opportunity for a normalized path to escape the intended volume directory boundary. Attack vectors are limited to local file system operations where an attacker can influence path inputs. The vendor explicitly notes no exploitable scenario has been discovered; the issue is theoretical and patched for hardening purposes rather than to address active exploitation.

Affected products

  • Craft CMS Craft CMS >=4.0.0-RC1, <4.18.2 and >=5.0.0-RC1, <5.10.6

Timeline

  • 2026-07-25: disclosed: Original advisory published (GHSA-7hxc-f267-h5q7)
  • 2026-08-11: disclosed: Duplicate advisory published (GHSA-9w6w-8x3c-hfqp)
  • 2026-08-11: patched: Patches released: Craft CMS 4.18.2 and 5.10.6
  • 2026-09-01: other: Duplicate advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.