CVE-2026-72783
Received
Received - Intake
Path Traversal in Craft CMS
Vulnerability report for CVE-2026-72783, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-11
Last updated on: 2026-08-11
Assigner: VulnCheck
Description
Description
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior validation assumptions (a desanitization-style issue) and potentially resolve to files outside the intended volume directory. The vendor notes the issue is not directly exploitable and no exploitable scenario has been discovered; the fix is recommended for hardening.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| craftcms | craft | From 5.0.0-rc1 (inc) to 5.10.6 (exc) |
| craftcms | craft | From 4.0.0-rc1 (inc) to 4.18.2 (exc) |
| craftcms | craft_cms | From 5.0.0-rc1 (inc) to 5.10.6 (exc) |
| craftcms | craft_cms | From 4.0.0-rc1 (inc) to 4.18.2 (exc) |
| craftcms | craft_cms | From 5.0.0-rc1 (inc) to 5.10.5 (inc) |
| craftcms | craft_cms | From 4.0.0-rc1 (inc) to 4.18.1 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
