Saloon, a PHP library used for API integrations, contains a path traversal flaw in its fixture handling logic. Before version 4.0.0 the system accepted fixture names directly as file path components. An attacker who could influence the fixture name, such as through request parameters or configuration values, could inject path segments like ../ or ../../etc/passwd. This allows reading arbitrary files or writing files wherever the PHP process has permission. The flaw maps to CWE‑22 and poses a threat to confidentiality and integrity.

The issue affects saloonphp:saloon products for all releases prior to 4.0.0. There is no narrower version restriction listed; therefore any version from the earliest releases up to 3.x is vulnerable. The vendor recommends upgrading to version 4.0.0 or later, where input validation and path checking have been added to the fixture layer.

The CVSS score of 8.0 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not catalogued in CISA KEV. Attackers would need to supply a crafted fixture name with a user‑controlled source; thus the vector is likely application‑level, possibly via an API endpoint exposing new fixtures or legacy configuration files. The confirmed risk is that an adversary could read sensitive system files or overwrite configuration and code files, potentially leading to compromise of the application or further lateral movement.