Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path traversal

A path traversal weakness exists in Craft CMS's ensurePathIsContained function due to validation occurring prior to path normalization, potentially allowing paths to escape the intended volume directory. This desanitization-style issue affects versions >=4.0.0-RC1 before 4.18.2 and >=5.0.0-RC1 before 5.10.6. The vendor notes no direct exploitability or discovered exploit scenarios, recommending the fix primarily for hardening.

The vulnerability could theoretically allow an attacker with local access to reference files outside the intended directory, potentially exposing sensitive files. However, no direct exploit scenario has been identified, and the vendor indicates the issue is not directly exploitable.

Apply the vendor-recommended updates to Craft CMS versions 4.18.2 or later and 5.10.6 or later to harden the system against this theoretical path traversal issue. Since no exploit is known, the fix is precautionary.