CVE-2026-72783 craftcms CVE debrief

Who should care

Users of Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 should review and apply patches. System administrators, security teams, and operators responsible for maintaining Craft CMS installations should be aware of this theoretical path traversal weakness and take appropriate measures to secure their systems. This includes verifying system configurations, monitoring for suspicious activity, and ensuring that compensating controls are in place where necessary.

Technical summary

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The weakness arises from the order of operations, where path validation occurs before normalization, potentially allowing paths to be normalized to locations outside the intended volume directory. This issue is noted by the vendor as not directly exploitable and no exploitable scenario has been discovered. However, applying patches is recommended for hardening.

Defensive priority

Medium-priority defensive review recommended due to theoretical path traversal weakness in Craft CMS.

Recommended defensive actions

• Review and apply vendor patches for Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2
• Verify system configurations and inventory for potential exposure
• Monitor system logs for suspicious activity
• Perform a thorough review of system configurations to ensure they align with security best practices
• Consider implementing compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved
• Continuously monitor for new information regarding this vulnerability and adjust defensive strategies as necessary

Evidence notes

Theoretical path traversal weakness in Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2; vendor notes issue not directly exploitable, no exploitable scenario discovered. The weakness lies in the ensurePathIsContained function of the Local file system class, where the order of operations validates the path before normalization, potentially leading to desanitization-style issues. Defenders should verify system configurations, review and apply patches, and monitor system logs for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.