Craft CMS contains a theoretical path traversal vulnerability in the Local file system class's ensurePathIsContained function due to the order of path validation and normalization. Although no exploitable scenario has been identified, the issue could allow desanitization of file paths. A fix is available and recommended for hardening purposes.