CVE-2026-111448 Details
Description
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory, allowing access outside the intended root, including limited file disclosure. Separately, the CLI database-dump output check can write outside the application root to an existing writable case-distinct sibling directory; that action requires the CLI POST, loopback and password gate. This is fixed in 4.2.0.
A vulnerability exists in Wheels versions 4.0.0 through 4.1.2, where path-containment checks are performed using case-insensitive comparisons on case-sensitive filesystems. This flaw can be exploited to access files outside the intended directory root, leading to limited file disclosure. The issue arises because canonical-path checks for various zip entries and asset mappings can be manipulated through existing symlinks, allowing access to case-distinct sibling directories. Additionally, the CLI database-dump feature can inadvertently write files outside the application root, given certain conditions are met.
Users can upgrade to Wheels version 4.2.0, where this vulnerability is fixed. Path-containment checks now compare canonical paths exactly, respecting case sensitivity and directory boundaries. As an additional precaution, keep the CLI gate password confidential and disable development tools outside of the development environment.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wheels-dev/wheels/security/advisories/GHSA-m63x-8m98-225v | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wheels-dev Wheels | >= 4.0.0, <= 4.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |