Live › vulnerability › CVE-2026-111448
Go to dashboardWheels 4.0.0 through 4.1.2 compares paths case-insensitively on case-sensitive filesystems, so a symlink to a case-distinct sibling directory can pass containment checks. An attacker can reach files outside the intended root, with limited file disclosure, and the CLI database-dump check can write outside the application root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications running Wheels 4.0.0 through 4.1.2 on case-sensitive filesystems, which is typically Linux. The file-read path needs an existing symlink to a case-distinct sibling directory, so the exposure depends on what is on disk. The CLI write path also needs the CLI POST, loopback and password gate to be open. Teams on 4.2.0 or later, or on case-insensitive filesystems such as default macOS and Windows, can skip it.
No product ranges from the sources yet.
4.0.0 through 4.1.24.2.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory, allowing access outside the intended root, including limited file disclosure. Separately, the CLI database-dump output check can write outside the application root to an existing writable case-distinct sibling directory; that action requires the CLI POST, loopback and password gate. This is fixed in 4.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-111448")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.