EUVD-2026-56107
GHSA-9w6w-8x3c-hfqp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CMS surface warrants AV:N, but AC:H reflects no known exploit path; PR:L applied because triggering asset reads realistically requires some application-level access.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior validation assumptions (a desanitization-style issue) and potentially resolve to files outside the intended volume directory. The vendor notes the issue is not directly exploitable and no exploitable scenario has been discovered; the fix is recommended for hardening.
AnalysisAI
Path traversal weakness in Craft CMS's Local volume file system class exposes servers running versions 5.0.0-RC1 through 5.10.5 or 4.0.0-RC1 through 4.18.1 to a theoretical desanitization-style flaw in the ensurePathIsContained function. The validate-before-normalize ordering allows a crafted path to pass validation in its raw form yet resolve outside the intended volume directory after normalization, potentially enabling reads of files beyond the designated asset directory. The vendor explicitly confirms no exploitable scenario has been discovered and classifies this as a hardening fix; no public exploit exists and this CVE does not appear in the CISA KEV catalog.
Technical ContextAI
The root cause is CWE-22 (Path Traversal) manifesting as a desanitization anti-pattern in the Local file system class within the Craft CMS asset handling pipeline. When an asset is retrieved, getFileStream on the Volume object delegates to the Local file system's own getFileStream, which constructs the full on-disk path by (1) validating the requested path, (2) normalizing it, and (3) prepending the volume's base directory prefix. The flaw is in the sequencing: normalization (step 2) occurs after validation (step 1), so encoded sequences, redundant separators, or dot-segment paths that appear safe to the validator may resolve differently once the OS or framework normalizes them, invalidating the assumptions made during validation. The affected Composer package is craftcms/cms (CPE: cpe:2.3:a:craftcms:cms), covering both the 4.x and 5.x major release lines from their respective RC1 milestones.
RemediationAI
Upgrade to Craft CMS 5.10.6 or 4.18.2 as appropriate for the deployed major version; both are confirmed fixed releases per the vendor security advisory GHSA-7hxc-f267-h5q7 and corresponding patch commits a8425b6c and bd6b9c17. Because the vendor confirms no known exploitable scenario, scheduling this at the next routine maintenance window is reasonable for most deployments rather than requiring emergency patching. If immediate upgrade is not possible, restrict OS-level read permissions on the web server process user so it can only access the intended volume directories - this limits the blast radius of any path traversal even if a concrete exploit path is later identified. Additionally, auditing which Craft volumes are configured as Local versus remote provides clarity on actual exposure scope.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today