Junglewise Threat Intelligence

Craft CMS path traversal in Local file system class

Severity: low · CVSS 2.1 · Published 2026-08-06

Executive brief

Craft CMS, a popular content management system, contained a theoretical security flaw in how it handles local file paths for assets. While no active way to exploit this has been found, the flaw could potentially allow an attacker with high-level administrative access to access files outside of intended directories. This issue has been addressed in recent updates as a hardening measure to prevent future security risks.

Technical details

A potential path traversal vulnerability exists in the `ensurePathIsContained` function of the `Local` file system class in Craft CMS. The root cause is a 'desanitization' flaw where the system validated a file path before normalizing it; subsequent normalization could potentially invalidate the security assumptions made during the validation step. An attacker with high privileges could theoretically use this to access files outside the designated volume directory. While no direct exploit has been identified, the vendor has released patches (4.18.2 and 5.10.6) that reorder these operations to ensure normalization occurs before validation.

Affected products

  • Craft CMS Craft CMS >= 4.0.0-RC1, < 4.18.2; >= 5.0.0-RC1, < 5.10.6

Timeline

  • 2026-07-25: disclosed: Advisory published by vendor
  • 2026-06-16: patched: Versions 4.18.2 and 5.10.6 released
  • 2026-08-06: advisory: GitHub Advisory published

References