Listen to this Post
The `ensurePathIsContained` function of the Local file system class in Craft CMS is vulnerable to a path traversal flaw arising from an insecure order of operations: validation occurs before normalization, enabling a desanitization attack. When an asset is read, an `Asset` object invokes the `getFileStream` method of the relevant Volume, which in turn calls the `getFileStream` method of the file system class used by that Volume. For the Local file system, this method returns a stream to a file on the local disk after verifying and constructing the correct file path.
The path is constructed by first validating the input path, then normalizing it, and finally prefixing it with the local directory that houses the volume. This ordering opens a desanitization-style vulnerability: the normalization step can invalidate the assumptions made by the prior validation. For example, an attacker can supply a path containing a protocol scheme such as `file://` combined with directory traversal sequences (../). The validation step may treat the path as safe because it does not fully resolve the protocol or the normalized result, but after normalization the path resolves to a location outside the intended root directory.
Because the containment check is bypassed, an authenticated user with administrative privileges could read or manipulate files outside the defined storage root. The vulnerability affects Craft CMS versions 4.x and 5.x, specifically all releases from 4.0.0 up to but not including 4.18.2, and from 5.0.0 up to but not including 5.10.6. Although the issue was initially considered theoretical and no working exploit was publicly known at the time of disclosure, subsequent analysis confirmed that protocol‑prefixed traversal sequences can indeed bypass the boundary checks. The vendor has released patches that correct the order by normalizing paths before validation. Administrators are strongly advised to update to the fixed versions to eliminate the risk of unauthorized file access.
DailyCVE Form:
Platform: Craft CMS
Version: 4.x, 5.x (>=4.0.0,<4.18.2; >=5.0.0,<5.10.6)
Vulnerability : Path Traversal (CWE-22)
Severity: Medium (CVSS 4.9)
date: 2026-08-06
Prediction: Already patched in 4.18.2/5.10.6
What Undercode Say:
Analytics:
- Attack Vector: Network
- Exploit Status: PoC available
- CISA KEV: Not Listed
- Ransomware Use: No
Bash commands to check version and update:
Check current Craft CMS version composer show craftcms/cms | grep versions Update to the latest patched version composer update craftcms/cms Verify the update php craft version
Code snippet showing the flawed order (conceptual):
// Vulnerable order: validation before normalization $validated = validatePath($userInput); $normalized = normalizePath($validated); $fullPath = $volumePrefix . $normalized;
Fixed order (after patch):
// Secure order: normalize before validation $normalized = normalizePath($userInput); $validated = validatePath($normalized); $fullPath = $volumePrefix . $validated;
Exploit:
An authenticated attacker with admin privileges can craft a file path that includes a protocol scheme (e.g., file://) and `../` sequences. Because validation occurs before normalization, the initial check does not detect the traversal. After normalization, the path resolves to an absolute location outside the volume’s root directory, allowing the attacker to read arbitrary files from the server’s local disk.
Protection:
- Upgrade Craft CMS core to version 4.18.2 or 5.10.6 (or later).
- Configure the web server process with the minimum necessary system privileges to restrict file access.
- Deploy a Web Application Firewall (WAF) with rules that detect and block `file://` URIs and directory traversal sequences (
../,..\) in administrative parameters. - Review all asset volume configurations to ensure local paths are properly restricted.
Impact:
Successful exploitation allows an authenticated user with administrative privileges to read or manipulate files outside the intended storage directory, potentially exposing sensitive configuration files, application source code, or other system data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
