CVE-2026-55374 Details

A path traversal vulnerability has been identified in the Canto SaaS API PHP library, specifically in versions prior to 3.0.0. The issue arises in the `Request::buildRequestUrl()` method, which fails to properly encode individual path segments before incorporating them into the request URL. This flaw allows an attacker to manipulate the destination endpoint by injecting untrusted path variable values, such as traversal sequences or query delimiters. As a result, unauthorized read or write operations can be performed using the application's privileges on the same Canto instance. However, this vulnerability does not affect applications that only use trusted and validated identifiers.

Users are advised to upgrade to Canto SaaS API version 3.0.0 or later, where this vulnerability has been fixed. In version 3.0.0, all path segments are properly URL-encoded before being added to the request URL. If an upgrade is not possible, validate untrusted values before passing them as path variables, ensuring they conform to a trusted pattern.