The vulnerability in Craft CMS is a path traversal flaw that occurs in the ensurePathIsContained function of the Local file system class. Validation occurs before path normalization, allowing a path that passes validation to resolve to a location outside the intended volume after normalization. This could enable an attacker to access or modify files that should be protected, thereby compromising confidentiality or integrity. The vendor notes no direct exploit has been identified, but the theoretical design flaw enables potential unauthorized file access if an attacker can influence the path argument.

Craft CMS, versions starting with 5.0.0‑RC1 through 5.10.5‑RC1 and 4.0.0‑RC1 through 4.18.1, are affected by this path traversal weakness.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, implying a relatively low current exploitation probability. Nonetheless, because the flaw could allow access to files outside the intended directory, it poses a risk if an attacker can supply crafted file paths via user input or configuration. At present, no documented exploitation scenario exists, but the theoretical nature of the flaw warrants prompt remediation.