CVE-2026-72783: Craft CMS Path Traversal Vulnerability

CVE-2026-72783 Overview

CVE-2026-72783 is a path traversal weakness [CWE-22] in Craft CMS affecting versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2. The flaw resides in the ensurePathIsContained function of the Local file system class. The function validates a supplied path before normalization, so subsequent normalization can invalidate the earlier check and resolve to files outside the intended volume directory. The vendor classifies the issue as theoretical: no exploitable scenario has been identified, and the fix is issued as a hardening measure rather than a response to active abuse.

Critical Impact
A desanitization-style ordering bug in Local file system path validation could allow resolution of paths outside the intended volume directory, though no exploitable scenario has been demonstrated.

Affected Products

Craft CMS >= 5.0.0-RC1 and < 5.10.6
Craft CMS >= 4.0.0-RC1 and < 4.18.2
Local file system volume class in Craft CMS

Discovery Timeline

2026-08-11 - CVE-2026-72783 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72783

Vulnerability Analysis

The defect exists in the ensurePathIsContained routine of Craft CMS's Local file system class. This routine is intended to enforce that a caller-supplied path resolves within a configured volume directory. The implementation validates the raw path first, then normalizes it. Normalization can collapse traversal sequences and symbolic components after validation has already succeeded, undermining the earlier check.

An attacker able to influence a path passed into this routine could, in theory, cause the resolved path to point outside the intended directory boundary. Because Craft CMS is a content management system commonly deployed as a public web application, file-system boundary enforcement is a security-relevant control for tenant and volume isolation.

The vendor states no exploitable scenario has been discovered. The upstream fix is a hardening change that reverses the order of operations so that path normalization occurs before validation.

Root Cause

The root cause is a Time-of-Check to Time-of-Use style ordering error, sometimes referred to as a desanitization issue. Validation is performed on an un-normalized input, and normalization is then applied, allowing the validated form and the used form to differ. Path traversal sequences such as .. segments or redundant separators can survive validation and be interpreted differently at the file system layer.

Attack Vector

Exploitation requires local attack vector conditions and a code path that feeds attacker-influenced input into ensurePathIsContained. The CVSS 4.0 vector reports confidentiality impact only, with no integrity or availability effects. No public proof of concept exists, no exploit is available in Exploit-DB, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the GitHub Security Advisory and the VulnCheck Advisory on Craft CMS for further technical detail.

Detection Methods for CVE-2026-72783

Indicators of Compromise

No public indicators of compromise have been published for this issue. The vendor reports no known exploitation.
Unexpected file reads from paths containing .. sequences directed at Craft CMS volume handlers should be treated as suspicious.

Detection Strategies

Inventory Craft CMS deployments and confirm installed version against the fixed releases 5.10.6 and 4.18.2.
Review application logs for requests to asset, volume, or file endpoints containing encoded or literal traversal sequences such as %2e%2e%2f or ..\.
Audit custom plugins and integrations that call into the Local file system class for untrusted path input.

Monitoring Recommendations

Enable web server access logging and forward Craft CMS PHP error logs to a centralized log store for retrospective search.
Alert on file system access by the web server process to paths outside configured volume roots.
Track outbound file read patterns from the Craft CMS host that deviate from established baselines.

How to Mitigate CVE-2026-72783

Immediate Actions Required

Upgrade Craft CMS 5.x installations to version 5.10.6 or later.
Upgrade Craft CMS 4.x installations to version 4.18.2 or later.
Restrict operating-system permissions on the web server user so that access is limited to the configured volume directories.
Review third-party plugins that extend or wrap the Local file system class for similar ordering issues.

Patch Information

The vendor has released fixed versions 5.10.6 and 4.18.2. The patch reorders operations in ensurePathIsContained so that the path is normalized before it is validated against the allowed volume root. Details are published in the GitHub Security Advisory GHSA-7hxc-f267-h5q7.

Workarounds

No official workaround is documented. Upgrading to a patched release is the vendor-recommended remediation.
As defense in depth, enforce chroot-style isolation or containerization so the Craft CMS process cannot read files outside its intended volume roots.
Apply least-privilege file system permissions to directories adjacent to Craft CMS asset volumes.

bash

# Upgrade Craft CMS via Composer to a patched release
composer require craftcms/cms:^5.10.6 --update-with-dependencies
# Or for the 4.x branch
composer require craftcms/cms:^4.18.2 --update-with-dependencies

# Run pending migrations after upgrade
php craft up