CVE-2026-72783

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1

Description A theoretical path traversal weakness exists in the ensurePathIsContained() function of the Local file system class. The issue arises because the path is validated before normalization, which may allow the normalization process to invalidate previous validation assumptions—a desanitization-style issue—potentially allowing access to files outside the intended volume directory. This issue is not considered directly exploitable, and no exploitable scenario has been discovered.

Recommendations Update Craft CMS versions 5.0.0-RC1 through 5.10.5 to version 5.10.6. Update Craft CMS versions 4.0.0-RC1 through 4.18.1 to version 4.18.2.