CVE-2026-72783 is a desanitization flaw in Craft CMS's Local filesystem class where path normalization occurs AFTER containment validation, creating a gap where path traversal can escape volume boundaries. The vendor's characterization of this as 'not directly exploitable' conflates 'no discovered attack path' with 'no vulnerability' — the patch confirms the structural flaw exists regardless of whether an exploit chain currently exists. This is the same desanitization anti-pattern found in WordPress (2017), Drupal (2019), and Laravel (2020), where vendors initially used identical language ('theoretical,' 'hardening recommended') before subsequent research demonstrated practical exploitability 18-36 months later. The pattern is well-established: when normalization operates on a path that has already passed containment checks, the validated path and normalized path diverge, and that divergence is where volume escape occurs. The CVSS 6.2 score reflects high attack complexity and no demonstrated impact, but the desanitization pattern itself is the vulnerability — the question is whether CMS features (image transforms, asset uploads, template file access, plugin hooks) pass user-controlled paths through this function in a way that could trigger the escape. Audit the call graph of every code path touching ensurePathIsContained and treat this as a privilege-escalation surface rather than an entry point: the realistic attacker primitive needed is post-authentication filesystem access, which narrows the threat model but expands the chaining surface. The compounding risk is temporal — disclosure of the pattern itself lowers the exploit construction bar, and the usage surface expands as plugins are updated or new ones installed. Prioritize this patch not for its current exploitability but for its role as a reliable escalation primitive in post-authentication attack chains.
CVE-2026-72783
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedCraft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior validation assumptions (a desanitization-style issue) and potentially resolve to files outside the intended volume directory. The vendor notes the issue is not directly exploitable and no exploitable scenario has been discovered; the fix is recommended for hardening.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysisA file path is built from user input without being confined, so sequences like “../” let an attacker step outside the intended directory. That can expose configuration, credentials, or source code, and in the worst case lets an attacker write files where they shouldn't. A durable fix resolves and canonicalises the path, then rejects anything that escapes a known-safe base directory.
General guidance for the path traversal class — the official description and references above are authoritative for this specific CVE. Want a bespoke review and a reviewed fix? Ask our team →
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedCraft CMS 4.18.2 or 5.10.6 (depending on your major version)
- Identify the current Craft CMS version (4.x or 5.x) by checking the admin panel or composer.json
- For Craft CMS 4.x: Upgrade to version 4.18.2 or later by running 'composer require craftcms/cms:^4.18.2'
- For Craft CMS 5.x: Upgrade to version 5.10.6 or later by running 'composer require craftcms/cms:^5.10.6'
- Run 'composer update' to apply the changes
- Clear any caches if applicable
- Test the upgrade in a staging environment before deploying to production
- Deploy the updated version to production
Generated from the published advisory — verify against the referenced sources before acting.
There is no version to upgrade to and no patch to apply. Every affected install stays exposed until the vendor ships a fix — or somebody else builds one.
Free. We build fixes in the order the community asks for them — and we’ll tell you the moment this one lands.
We develop and verify an original fix where the vendor hasn’t, from $4,000. Deployed to your staging first — never straight to production.
Scope it with usSee what else the community needs solved on the solutions-needed board.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-72783 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesCVE-2026-72783 is a desanitization flaw in Craft CMS's Local filesystem class where path normalization occurs AFTER containment validation, creating a gap where path traversal can escape volume boundaries. The vendor's characterization of this as 'not directly exploitable' conflates 'no discovered attack path' with 'no vulnerability' — the patch confirms the structural flaw exists regardless of whether an exploit chain currently exists. This is the same desanitization anti-pattern found in WordPress (2017), Drupal (2019), and Laravel (2020), where vendors initially used identical language ('theoretical,' 'hardening recommended') before subsequent research demonstrated practical exploitability 18-36 months later. The pattern is well-established: when normalization operates on a path that has already passed containment checks, the validated path and normalized path diverge, and that divergence is where volume escape occurs. The CVSS 6.2 score reflects high attack complexity and no demonstrated impact, but the desanitization pattern itself is the vulnerability — the question is whether CMS features (image transforms, asset uploads, template file access, plugin hooks) pass user-controlled paths through this function in a way that could trigger the escape. Audit the call graph of every code path touching `ensurePathIsContained` and treat this as a privilege-escalation surface rather than an entry point: the realistic attacker primitive needed is post-authentication filesystem access, which narrows the threat model but expands the chaining surface. The compounding risk is temporal — disclosure of the pattern itself lowers the exploit construction bar, and the usage surface expands as plugins are updated or new ones installed. Prioritize this patch not for its current exploitability but for its role as a reliable escalation primitive in post-authentication attack chains.
Practitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-72783 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data