{"id":"CVE-2026-111448","kind":"vulnerability","aliases":["CVE-2026-111448"],"related":[],"title":"Wheels: case-insensitive path checks let symlinks escape the app root","description":"Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory, allowing access outside the intended root, including limited file disclosure. Separately, the CLI database-dump output check can write outside the application root to an existing writable case-distinct sibling directory; that action requires the CLI POST, loopback and password gate. This is fixed in 4.2.0.","summary":"Wheels 4.0.0 through 4.1.2 compares paths case-insensitively on case-sensitive filesystems, so a symlink to a case-distinct sibling directory can pass containment checks. An attacker can reach files outside the intended root, with limited file disclosure, and the CLI database-dump check can write outside the application root.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cfml","coldfusion","linux","package","wheels"],"not_affected_if":["case-insensitive-filesystem","version-4.2.0-or-later"],"how_to_check":"- Check the installed Wheels version in the application's dependencies, looking for `4.0.0` through `4.1.2`\n- Look for symlinks inside the application root that point to directories whose names differ only by letter case\n- Unknown whether the sources list other checks","fix":"- Upgrade Wheels to `4.2.0`\n- Unknown whether the sources give a workaround before upgrading","status":"open","published_at":"2026-10-16T04:18:31+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:45:19+00:00","updated_at":"2026-10-25T04:45:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:45:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Wheels to `4.2.0`\n- Unknown whether the sources give a workaround before upgrading","reach":"unknown","title":"Wheels: case-insensitive path checks let symlinks escape the app root","impact":"medium","summary":"Wheels 4.0.0 through 4.1.2 compares paths case-insensitively on case-sensitive filesystems, so a symlink to a case-distinct sibling directory can pass containment checks. An attacker can reach files outside the intended root, with limited file disclosure, and the CLI database-dump check can write outside the application root.","category":"package","nicknames":[],"who_cares":["wheels","coldfusion","cfml","linux"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Limited file disclosure and writes outside the application root.","analyst_note":"","how_to_check":"- Check the installed Wheels version in the application's dependencies, looking for `4.0.0` through `4.1.2`\n- Look for symlinks inside the application root that point to directories whose names differ only by letter case\n- Unknown whether the sources list other checks","needs_analyst":false,"not_affected_if":["version-4.2.0-or-later","case-insensitive-filesystem"],"who_is_affected":"Applications running Wheels 4.0.0 through 4.1.2 on case-sensitive filesystems, which is typically Linux. The file-read path needs an existing symlink to a case-distinct sibling directory, so the exposure depends on what is on disk. The CLI write path also needs the CLI POST, loopback and password gate to be open. Teams on 4.2.0 or later, or on case-insensitive filesystems such as default macOS and Windows, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000655,"input_tokens":3426,"output_tokens":625,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-111448':15A,18A '-2026':14A,17A '4.0.0':25B,79C '4.1.2':27B,81C '4.2.0':174C 'accept':114C 'access':128C 'action':161C 'allow':127C 'app':11A 'applic':76B,149C 'assets/docs':107C 'attack':53B 'canon':98C 'canonical-path':97C 'case':3A,31B,35B,44B,84C,94C,123C,156C 'case-distinct':43B,122C,155C 'case-insensit':2A,30B,83C 'case-sensit':34B,93C 'cfml':19B 'check':6A,51B,71B,91C,100C,144C 'cli':67B,139C,164C 'coldfus':20B 'compar':28B 'comparison':86C 'contain':50B,90C 'cve':13A,16A 'databas':69B,141C 'database-dump':68B,140C 'develop':106C 'directori':47B,126C,159C 'disclosur':64B,136C 'distinct':45B,124C,157C 'dump':70B,142C 'entri':103C 'escap':9A 'exist':118C,153C 'file':56B,63B,135C 'filesystem':37B,96C 'fix':172C 'gate':169C 'guid':108C 'imag':109C,111C 'includ':133C 'insensit':4A,32B,85C 'intend':59B,131C 'let':7A 'limit':62B,134C 'linux':21B 'loopback':166C 'map':105C 'output':143C 'outsid':57B,74B,129C,147C 'packag':22B,104C 'pass':49B 'password':168C 'path':5A,29B,89C,99C,115C 'path-contain':88C 'post':165C 'reach':55B 'requir':162C 'root':12A,60B,77B,132C,150C 'sensit':36B,95C 'separ':137C 'sibl':46B,125C,158C 'symlink':8A,40B,119C 'tag':112C 'use':82C 'wheel':1A,23B,24B,78C 'writabl':154C 'write':73B,146C 'zip':102C","nicknames":[],"mitigations":[],"who_affected":"Applications running Wheels 4.0.0 through 4.1.2 on case-sensitive filesystems, which is typically Linux. The file-read path needs an existing symlink to a case-distinct sibling directory, so the exposure depends on what is on disk. The CLI write path also needs the CLI POST, loopback and password gate to be open. Teams on 4.2.0 or later, or on case-insensitive filesystems such as default macOS and Windows, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T04:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111448","severity":null,"published_at":"2026-10-16T04:18:31+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}