Wheels EUVD-2026-102601

The primary flaw requires: (1) deployment on a case-sensitive filesystem (e.g., typical Linux), and (2) a pre-existing symlink pointing to a case-distinct sibling directory of the intended root - the case-insensitive comparison then accepts the case-differing path and permits access outside the root via the canonical-path checks for zip entries, package mappings, development assets/docs, guide images, or image tags. These environmental prerequisites (not controllable by the attacker) are the main limiting factor and justify the high attack complexity. The separate CLI database-dump write-outside-root condition is far more restricted: it requires the CLI POST action, loopback access, and passing the password gate, and only writes to an existing writable case-distinct sibling directory. Deployments on case-insensitive filesystems, or without such symlinks, are not exposed to the primary disclosure.

This is a low-priority issue that scores accordingly: CVSS 3.1 base of 3.7 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Although the attack vector is network-based and unauthenticated (PR:N), the high attack complexity (AC:H) is well justified - exploitation of the primary path-containment flaw depends on environmental preconditions outside the attacker's control: a case-sensitive filesystem AND a pre-existing symlink pointing to a case-distinct sibling directory. Impact is confined to limited file disclosure (C:L) with no integrity or availability effect. There is no EPSS score, no CISA KEV listing, and no public POC referenced - only the vendor GHSA advisory - so the signals are consistent rather than conflicting: low severity, no evidence of exploitation, and demanding preconditions. The secondary CLI database-dump write-outside-root issue is even more constrained, gated behind a CLI POST, loopback-only access, and a password check, making it effectively a local/operator-level concern rather than a remote threat. No signal suggests this rises above routine patch-when-convenient priority.

On a Wheels deployment running on a case-sensitive filesystem, an attacker crafts a request for a zip entry, package mapping, asset/doc, guide image, or image tag whose path differs only in letter case from the intended root, traversing through a pre-existing symlink to a case-distinct sibling directory to read files outside the intended root (limited disclosure). No public exploit code is identified at time of analysis, and the high complexity means the attacker is dependent on the specific symlink/filesystem conditions already existing in the target environment.