CVE-2026-72783 in Craft CMS
Summary
by MITRE • 08/11/2026
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior validation assumptions (a desanitization-style issue) and potentially resolve to files outside the intended volume directory. The vendor notes the issue is not directly exploitable and no exploitable scenario has been discovered; the fix is recommended for hardening.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within Craft CMS versions between specific release candidates and vulnerable patches, affecting both version 4 and version 5 branches of the content management platform. The weakness resides in the Local file system class's ensurePathIsContained function which implements a flawed validation sequence that creates a theoretical path traversal scenario. The core issue manifests when the system first validates a path against expected boundaries before applying normalization operations, creating a window where subsequent normalization can potentially bypass earlier validation checks through what cybersecurity experts would classify as a desanitization-style vulnerability pattern.
The technical flaw operates through a specific order of operations that violates fundamental security principles for path validation. When a path is initially validated against the intended volume directory, the system assumes certain boundary conditions remain intact. However, during the normalization phase, path components may be resolved or altered in ways that can cause the originally validated path to resolve to locations outside the intended containment boundaries. This creates a scenario where attacker-controlled input could theoretically manipulate filesystem access through carefully crafted paths that pass initial validation but fail during normalization. The vulnerability specifically affects how relative paths and symbolic links are handled within the file system abstraction layer, potentially allowing unauthorized access to files outside the designated storage areas.
While vendors have noted this issue as not directly exploitable and no concrete exploitation scenarios have been discovered in the wild, the theoretical nature of the vulnerability presents significant risk for security hardening. The potential impact extends beyond immediate file access violations to encompass broader system integrity concerns where proper containment boundaries may be bypassed. Organizations running Craft CMS installations should consider this weakness particularly dangerous due to its potential to escalate into more serious vulnerabilities when combined with other exploitation techniques or when the application is deployed in less restricted environments. The vulnerability's classification aligns with common security patterns identified in CWE-22 Path Traversal and ATT&CK technique T1059 Command and Scripting Interpreter, though it does not directly map to specific attack patterns due to its theoretical nature.
Mitigation strategies should focus on implementing immediate patch updates to the affected versions, ensuring that all instances of Craft CMS are updated to at least version 4.18.2 or 5.10.6 respectively. System administrators should also consider implementing additional monitoring around file system access patterns and validating that normalization operations maintain expected boundary conditions. Organizations may want to apply defensive programming practices such as revalidating paths after normalization, implementing stricter input sanitization, and ensuring proper separation of filesystem operations from user-controllable inputs. The fix addresses the root cause by modifying the order of validation and normalization operations to prevent the desanitization scenario that enables this theoretical traversal condition.