Craft CMS: Incorrect path validation could potentially lead to path traversal
Craft CMS contains a theoretical path traversal vulnerability in the Local file system class's ensurePathIsContained function. The vulnerability arises from the order of validation and normalization of file paths, which could allow desanitization and potential path traversal. However, no exploitable scenario has been discovered, and the issue is considered low severity. A patch is available and recommended for hardening purposes.
AI Analysis
Technical Summary
The vulnerability involves the ensurePathIsContained function in the Local file system class of Craft CMS. When reading a file, the system validates the path, normalizes it, and then constructs the final file path by prefixing it with the volume's local directory path. The order of these operations can lead to a desanitization-style vulnerability where normalization invalidates prior validation assumptions, theoretically enabling path traversal. Despite this, no direct exploit has been identified. The issue is classified under CWE-22 (Path Traversal).
Potential Impact
No direct exploitation has been observed or demonstrated. The vulnerability is theoretical and does not currently allow unauthorized access or compromise. The impact is therefore low, but it could potentially lead to unauthorized file access if an exploit scenario is found.
Mitigation Recommendations
A patch is available for this vulnerability and applying it is recommended to harden the system. Since no exploit is known, immediate urgent action is not required, but updating to the fixed version will mitigate the theoretical risk.
Craft CMS: Incorrect path validation could potentially lead to path traversal
Description
Craft CMS contains a theoretical path traversal vulnerability in the Local file system class's ensurePathIsContained function. The vulnerability arises from the order of validation and normalization of file paths, which could allow desanitization and potential path traversal. However, no exploitable scenario has been discovered, and the issue is considered low severity. A patch is available and recommended for hardening purposes.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability involves the ensurePathIsContained function in the Local file system class of Craft CMS. When reading a file, the system validates the path, normalizes it, and then constructs the final file path by prefixing it with the volume's local directory path. The order of these operations can lead to a desanitization-style vulnerability where normalization invalidates prior validation assumptions, theoretically enabling path traversal. Despite this, no direct exploit has been identified. The issue is classified under CWE-22 (Path Traversal).
Potential Impact
No direct exploitation has been observed or demonstrated. The vulnerability is theoretical and does not currently allow unauthorized access or compromise. The impact is therefore low, but it could potentially lead to unauthorized file access if an exploit scenario is found.
Mitigation Recommendations
A patch is available for this vulnerability and applying it is recommended to harden the system. Since no exploit is known, immediate urgent action is not required, but updating to the fixed version will mitigate the theoretical risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7hxc-f267-h5q7
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6a7573bbbf8831d539d94185
Added to database: 08/07/2026, 05:57:15 UTC
Last enriched: 08/07/2026, 07:01:11 UTC
Last updated: 08/07/2026, 15:39:23 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.