CVE-2026-72783 describes a theoretical path traversal weakness in Craft CMS's Local file system class, specifically in the ensurePathIsContained function. The vulnerability is due to the order of operations where path validation happens before normalization, allowing normalization to potentially resolve paths outside the intended volume directory. Despite this, the vendor has not identified any direct exploitability or practical attack scenarios. The vulnerability affects Craft CMS versions >=5.0.0-RC1 before 5.10.6 and >=4.0.0-RC1 before 4.18.2. The issue is considered a desanitization-style problem and the fix is recommended for hardening purposes.

The vulnerability could theoretically allow path traversal outside the intended directory, but no direct exploit or attack scenario has been demonstrated. Therefore, the practical impact is limited, and it does not currently pose an active security risk.

No official patch or remediation level is indicated. The vendor recommends applying the fix for hardening purposes. Since no exploit is known, immediate urgent action is not required, but updating to versions 5.10.6 or later (for 5.x) and 4.18.2 or later (for 4.x) when available is advised to mitigate the theoretical risk.