Path Containment Vulnerability in Wheels by Wheels Dev
CVE-2026-111448

3.7LOW

Key Information:

Vendor

Wheels

Status
Wheels
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111448?

Wheels versions 4.0.0 through 4.1.2 are susceptible to a path containment vulnerability. This issue arises due to case-insensitive comparisons in path checks on case-sensitive filesystems. As a result, checks for canonical paths related to zip entries and other resources may inappropriately allow access to files outside of the intended directory structure, potentially leading to unauthorized file exposure. Furthermore, the CLI database-dump functionality may inadvertently write outside of the application root, compromising data integrity. This vulnerability was addressed in version 4.2.0.

Affected Version(s)

Wheels 4.0.0 < 4.2.0

References

https://github.com/wheels-dev/wheels/security/advisories/...
vendor-advisory

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.