{"uuid": "f6f66d37-b44f-411d-9985-fe071c839122", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-7HXC-F267-H5Q7", "type": "seen", "source": "https://gist.github.com/alon710/1974365b37727353ce889eba0d08c78c", "content": "# GHSA-7HXC-F267-H5Q7: GHSA-7HXC-F267-H5Q7: Path Traversal via Validation-then-Normalization in Craft CMS\n\n> **CVSS Score:** 4.9\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/GHSA-7HXC-F267-H5Q7\n\n## Summary\nA path traversal vulnerability exists in the local filesystem driver of Craft CMS. Due to validation occurring before path normalization, directory containment checks can be bypassed by utilizing specific protocol schemes like 'file://' along with directory traversal sequences. This allows authenticated users with administrative privileges to access or manipulate files outside the defined storage root directory.\n\n## TL;DR\nCraft CMS local storage driver validates path containment before normalizing the path. This allows attackers to bypass boundary checks using protocol-prefixed traversal sequences, resulting in unauthorized local file access.\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 4.9\n- **Exploit Status**: PoC available\n- **CISA KEV**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- Craft CMS 4.x\n- Craft CMS 5.x\n- **Craft CMS**: >= 4.0.0, < 4.18.2 (Fixed in: `4.18.2`)\n- **Craft CMS**: >= 5.0.0, < 5.10.6 (Fixed in: `5.10.6`)\n\n## Mitigation\n\n- Upgrade Craft CMS core to patched versions 4.18.2 or 5.10.6\n- Configure web server process with minimal system privileges to restrict file access\n- Deploy WAF rules to detect and block 'file://' and directory traversal sequences in administrative parameters\n\n**Remediation Steps:**\n1. Identify the current Craft CMS version by checking composer.json or the administration dashboard.\n2. Execute 'composer update craftcms/cms' to update the core package to a secure version.\n3. Verify the installation of Craft CMS is running version 4.18.2+ or 5.10.6+.\n4. Review asset volume configurations to ensure local paths are restricted appropriately.\n\n## References\n\n- [GitHub Advisory Database: GHSA-7HXC-F267-H5Q7](https://github.com/advisories/GHSA-7HXC-F267-H5Q7)\n- [Craft 4.x Fix Commit](https://github.com/craftcms/cms/commit/a8425b6c707335e42c35ee2aaf03af50ea4a494d)\n- [Craft 5.x Fix Commit](https://github.com/craftcms/cms/commit/bd6b9c175b4892e042e8a03760c39b0e94c4c7d6)\n- [Craft CMS 4.18.2 Release Notes](https://github.com/craftcms/cms/releases/tag/4.18.2)\n- [Craft CMS 5.10.6 Release Notes](https://github.com/craftcms/cms/releases/tag/5.10.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-7HXC-F267-H5Q7) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T02:36:06.139840Z"}