Path traversal in Craft CMS - CVE-2026-72783
Published: July 29, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU139968
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72783
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to access files outside the intended directory.
The vulnerability exists due to path traversal in the ensurePathIsContained function of the Local file system class when constructing and normalizing file paths for file reads. A local user can supply a crafted path to access files outside the intended directory.
No exploitable scenario has been discovered, and the issue is described as theoretical.
Affected software
Craft CMS
How to mitigate CVE-2026-72783
Install security update from vendor's website.
Craft CMS - addressed in versions 4.18.2, 5.10.6