CyberRota Analysis
AI-GeneratedCraft CMS versions 5.0.0-RC1 to 5.10.6 and 4.0.0-RC1 to 4.18.2 have a theoretical path traversal vulnerability in the ensurePathIsContained function, which could allow access to files outside the intended directory due to improper validation order. While the vendor states that the issue is not directly exploitable and no active exploits have been identified, it poses a potential risk that could be leveraged in specific scenarios. Organizations using affected versions should prioritize applying the recommended fix to enhance their security posture.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior validation assumptions (a desanitization-style issue) and potentially resolve to files outside the intended volume directory. The vendor notes the issue is not directly exploitable and no exploitable scenario has been discovered; the fix is recommended for hardening.