CVE-2026-72783 json
Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained
published 3mo ago modified 18d ago also EUVD-2026-56107 , GHSA-7hxc-f267-h5q7
- cvss
- 6.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 9%
- public exploits
- 0
- none known
Summary
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior validation assumptions (a desanitization-style issue) and potentially resolve to files outside the intended volume directory. The vendor notes the issue is not directly exploitable and no exploitable scenario has been discovered; the fix is recommended for hardening.
Patch / fix
- packagist craftcms/cms 4.18.2, 5.10.6
- craftcms cms 4.18.2, 5.10.6
Is CVE-2026-72783 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | craftcms/cms | >=5.0.0-RC1, <5.10.6 >=4.0.0-RC1, <4.18.2 |
5.10.6 4.18.2 |
Affected products
- craftcms cms
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/craftcms/cms/commit/a8425b6c707335e42c35ee2aaf03af50ea4a494d
web
-
github.com
/craftcms/cms/commit/bd6b9c175b4892e042e8a03760c39b0e94c4c7d6
web
-
github.com
/craftcms/cms/security/advisories/GHSA-7hxc-f267-h5q7
vendor-advisory, web
-
vulncheck.com
/advisories/craft-cms-rc1-before-path-traversal-via-ensurepathiscontained
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-72783
advisory
-
github.com
/craftcms/cms
package
-
github.com
/craftcms/cms/releases/tag/4.18.2
web
-
github.com
/craftcms/cms/releases/tag/5.10.6
web
Sources
- CVE List CVE-2026-72783
- GitHub Advisory GHSA-7hxc-f267-h5q7
- NVD CVE-2026-72783
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.