CVE-2026-111448: Low severity Wheels vulnerability
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory, allowing access outside the intended root, including limited file disclosure. Separately, the CLI database-dump output check can write outside the application root to an existing writable case-distinct sibling directory; that action requires the CLI POST, loopback and password gate. This is fixed in 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to the path-containment bypass?
Wheels 4.0.0 through 4.1.2 are affected when running on a case-sensitive filesystem and a relevant case-distinct sibling directory is reachable through an existing symlink. The affected checks include zip entries, package mappings, development assets and documentation, guide images, and image tags.
What must an attacker be able to do to exploit the database-dump write issue?
The database-dump output path issue requires a CLI POST request, loopback access, and passing the password gate. It can write outside the application root only to an existing writable case-distinct sibling directory.
What is the impact of the containment-check issue?
The bypass can allow access outside the intended root, including limited file disclosure. The described database-dump issue can write outside the application root under its additional access conditions.
What should teams do to remediate this issue?
Upgrade Wheels to version 4.2.0, which fixes the issue.