CVE-2026-111448 in Wheels
Summary
by MITRE • 10/16/2026
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory, allowing access outside the intended root, including limited file disclosure. Separately, the CLI database-dump output check can write outside the application root to an existing writable case-distinct sibling directory; that action requires the CLI POST, loopback and password gate. This is fixed in 4.2.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Wheels versions 4.0.0 through 4.1.2 stems from a fundamental flaw in how the application handles path resolution on case-sensitive file systems. The core issue lies in the use of case-insensitive comparisons for path-containment checks, which fails to account for the strict case sensitivity enforced by underlying operating system environments such as Linux or macOS. This architectural oversight allows an attacker to bypass intended directory restrictions by leveraging symlinks that point to sibling directories with different casing than those explicitly allowed by the application logic. By manipulating the case of characters in a path segment, specifically through existing symbolic links, it is possible to traverse outside the designated root directory structure where sensitive files are stored or expected to remain isolated.
This flaw manifests primarily in two distinct operational contexts within the Wheels framework. First, canonical-path checks associated with zip entries, package mappings, development assets and documentation, guide images, and image tags are susceptible to path traversal attacks. When these components process user-supplied paths, they do not adequately normalize or validate the case sensitivity of the resolved file system location. Consequently, an attacker can craft a request that utilizes a symlink pointing to a case-distinct sibling directory, thereby gaining unauthorized read access to files located outside the intended application root. This results in limited but potentially significant information disclosure, as sensitive configuration files, source code snippets, or internal data structures may be exposed depending on the server's file system layout and permissions.
Secondly, a separate vulnerability exists within the command-line interface database-dump output check functionality. In this scenario, the application can write output files to locations outside the designated application root directory if an existing writable case-distinct sibling directory is present. This specific vector allows for arbitrary file writes in certain contexts, which could potentially lead to further exploitation such as code execution or configuration tampering if combined with other vulnerabilities. However, it is important to note that this particular write-based vulnerability requires a higher level of privilege and access constraints. It necessitates the use of the CLI interface via POST requests, local loopback network connections, and valid authentication credentials through a password gate mechanism. This limits the attack surface significantly compared to the read-oriented path traversal issues found in asset handling components.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as directory traversal or path traversal. The failure to enforce strict case-sensitive validation on case-sensitive file systems represents a deviation from secure coding practices recommended by industry standards for web application security. Furthermore, the exploitation technique involving symlink manipulation and case variation can be mapped to ATT&CK techniques related to Discovery and Collection, specifically those focusing on accessing remote system files or directories without proper authorization controls. The reliance on implicit trust of path inputs rather than explicit validation against a whitelist of allowed paths is a common pattern in such vulnerabilities.
To mitigate these risks, organizations running Wheels versions prior to 4.2.0 should upgrade immediately to the patched version where this logic has been corrected. For environments that cannot yet upgrade, administrators must ensure that file system permissions are tightly restricted so that even if path traversal occurs, the attacker cannot read sensitive files or write malicious content. Additionally, disabling unnecessary symlink functionality within the application's working directories can reduce the attack surface by removing the mechanism used to bypass case-sensitive checks. It is also advisable to implement strict input validation on all paths passed to zip handlers, asset loaders, and database dump utilities, ensuring that resolved canonical paths are strictly contained within expected root directories using case-sensitive comparison logic consistent with the underlying operating system's behavior.