DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-7HXC-F267-H5Q7: GHSA-7HXC-F267-H5Q7: Path Traversal via Validation-then-Normalization in Craft CMS

#security #cve #cybersecurity #ghsa

GHSA-7HXC-F267-H5Q7: Path Traversal via Validation-then-Normalization in Craft CMS

Vulnerability ID: GHSA-7HXC-F267-H5Q7
CVSS Score: 4.9
Published: 2026-08-06

A path traversal vulnerability exists in the local filesystem driver of Craft CMS. Due to validation occurring before path normalization, directory containment checks can be bypassed by utilizing specific protocol schemes like 'file://' along with directory traversal sequences. This allows authenticated users with administrative privileges to access or manipulate files outside the defined storage root directory.

TL;DR

Craft CMS local storage driver validates path containment before normalizing the path. This allows attackers to bypass boundary checks using protocol-prefixed traversal sequences, resulting in unauthorized local file access.

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network
  • CVSS Score: 4.9
  • Exploit Status: PoC available
  • CISA KEV: Not Listed
  • Ransomware Use: No

Affected Systems

  • Craft CMS 4.x
  • Craft CMS 5.x
  • Craft CMS: >= 4.0.0, < 4.18.2 (Fixed in: 4.18.2)
  • Craft CMS: >= 5.0.0, < 5.10.6 (Fixed in: 5.10.6)

Code Analysis

Commit: a8425b6

Fix path traversal in local filesystem driver by normalizing paths before validation on Craft CMS 4.x

Commit: bd6b9c1

Fix path traversal in local filesystem driver by normalizing paths before validation on Craft CMS 5.x

Exploit Details

  • GitHub Advisory: Advisory containing conceptual proof of concept details for path containment bypass

Mitigation Strategies

  • Upgrade Craft CMS core to patched versions 4.18.2 or 5.10.6
  • Configure web server process with minimal system privileges to restrict file access
  • Deploy WAF rules to detect and block 'file://' and directory traversal sequences in administrative parameters

Remediation Steps:

  1. Identify the current Craft CMS version by checking composer.json or the administration dashboard.
  2. Execute 'composer update craftcms/cms' to update the core package to a secure version.
  3. Verify the installation of Craft CMS is running version 4.18.2+ or 5.10.6+.
  4. Review asset volume configurations to ensure local paths are restricted appropriately.

References

Read the full report for GHSA-7HXC-F267-H5Q7 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)