CVE-2026-55374
Received Received - Intake

Path Traversal in Canto SaaS API PHP Library

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::getPathVariables() without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When a consuming application supplies an untrusted path variable value, path traversal sequences, query delimiters, or fragment delimiters can change the destination endpoint before AbstractEndpoint::sendRequest() attaches the configured authentication token. An attacker who controls that path variable value through the consuming application can cause unintended reads or writes with the configured application's privileges on the same Canto instance, but applications that pass only trusted and validated identifiers are not exploitable. This issue is fixed in version 3.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55374
EUVD
EUVD-2026-78905

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
canto saas_api 3.0.0
jleehr canto-saas-api 3.0.0
jleehr canto-saas-api to 3.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in canto-saas-api versions before 3.0.0. The Request::buildRequestUrl() function combines path variables without properly encoding them. If an attacker provides a malicious path variable, they can manipulate the URL to access unintended endpoints. This could allow unauthorized reads or writes within the same Canto instance using the application's privileges.

Detection Guidance

Check if your application uses canto-saas-api versions prior to 3.0.0. Inspect code for usage of Request::buildRequestUrl() with untrusted path variables. Monitor for unexpected API requests or responses indicating path traversal or endpoint manipulation.

Impact Analysis

If you use an affected version of canto-saas-api and pass untrusted input as path variables, an attacker could exploit this to read or modify data in your Canto instance without proper authentication. Trusted applications passing only validated identifiers are not at risk.

Mitigation Strategies

Upgrade canto-saas-api to version 3.0.0 or later. Validate and sanitize all path variable inputs in your application. Ensure only trusted identifiers are passed to Request::getPathVariables().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart