CVE-2026-110909 Details

A vulnerability in Wheels CLI versions through 4.1.0 allows for credential exposure and unintended command execution on a different local application's server. The CLI does not verify that the local development server responding to its HTTP requests belongs to the current project. As a result, a process listening on a targeted port can intercept the project's reload password and code sent through 'wheels reload' or 'wheels console'. The 'wheels console' command also probes common ports when the project server is unavailable. Additionally, other CLI commands can perform unintended state-changing operations on a different local application's server and database. Exploitation requires a process to be listening on a targeted local port and the developer to execute an affected command.

This vulnerability is fixed in Wheels CLI version 4.1.1. Users should upgrade to this version and copy the header-mapping block from the current template's 'public/Application.cfc' into their own 'public/Application.cfc' file. After the upgrade, the CLI will only send commands that change state or evaluate code, as well as the reload password, to the project's own development server. Until the upgrade, users can assign each project a unique port in 'lucee.json' and stop other local development servers that might interfere.