Wheels 4.0.0 through 4.1.2 performs case-insensitive comparisons when checking that file paths are contained within an intended root. On case-sensitive filesystems this allows an attacker to craft a symlink pointing to a case-distinct sibling directory and to bypass containment, thereby reading files outside the target directory or writing to an adjacent writable directory through the CLI database‑dump feature. This bug, classified as CWE‑178, results in limited file disclosure or restricted write access but does not provide full remote code execution.

The affected vendor is Wheels, delivering the Wheels product. Versions 4.0.0 up to and including 4.1.2 are vulnerable. The issue is fixed in 4.2.0, which should be deployed wherever earlier releases are in use.

The associated CVSS score of 3.7 indicates Low severity; the EPSS score of 0.00208 shows a very low but nonzero chance of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires crafting specific inputs or invoking the CLI database‑dump endpoint, so the attack vector is likely local or requires authenticated access. Because the effect is limited to file disclosure or controlled write outside an intended root, the overall risk is low but mitigable by updating the software.