Craft CMS: Incorrect path validation could potentially lead to path traversal

Overview

The ensurePathIsContained function of the Local file system class is theoretically vulnerable to path traversal, although no exploitable scenario has been discovered.

When a file is read, an Asset object uses the getFileStream method of the Volume where the asset file is stored, which in turn uses the getFileStream method of the file system class used by that Volume. For the Local file system, this function returns a stream to a file on the local disk after verifying and creating the correct file path.

The file path is constructed by first validating the path and then adding a prefix to the validated and normalized path. The prefix is the path to the local directory that houses the particular volume. The order of operations matters here: first, a validation step, afterward a normalization step, and finally the construction of the resulting file path. This opens the possibility of a desanitization-style vulnerability, where the normalization invalidates the assumptions made by the validation or sanitization that preceded it.

Impact

The issue is not directly exploitable, but for hardening, a fix is recommended regardless.

Affected packages

• craftcms/cms >= 5.0.0-RC1, < 5.10.6
• craftcms/cms >= 4.0.0-RC1, < 4.18.2

Remediation

Upgrade to a patched release:

• craftcms/cms 5.10.6
• craftcms/cms 4.18.2