{"schema":"threatline.record/2","record":{"id":"GHSA-m63x-8m98-225v","aliases":["GHSA-m63x-8m98-225v"],"summary":"Path containment checks compare paths case-insensitively on case-sensitive filesystems","details":"### Impact\nSeveral checks that keep a file path inside an allowed directory compare the resolved path against the root without regard to letter case. On a case-sensitive filesystem (most Linux deployments), `/srv/App` and `/srv/app` are different directories, but these checks treat a path under the second as inside the first.\n\n- **Database dump output path:** the CLI database dump confines its output file to the application root using a case-insensitive prefix comparison. An output path such as `../app/dump.sql` from an application rooted at `/srv/App` is accepted and written outside the root, if that sibling directory exists and is writable. This command is a mutating CLI action behind the CLI gate (POST, loopback, password).\n- **Symlink-dependent checks:** zip extraction entry checks, package mapping paths, the development assets/docs resolver, guide images and the image-tag path check use the same case-insensitive comparison on canonical paths. Each requires an existing symbolic link that points to a case-distinct sibling directory.\n\n### Patches\nFixed in 4.2.0. Path-containment checks now compare canonical paths exactly (case-sensitively), with separator-qualified boundaries and exact-root equality; the existing lexical and authorization checks are unchanged.\n\n### Workarounds\n- Keep the CLI gate password secret and the dev tools disabled outside development.\n- Avoid sibling directories whose names differ from the application, package or asset roots only by letter case, and avoid symbolic links inside those roots that point outside them.","categories":["Unclassified"],"product":"wheels","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/wheels-dev/wheels/security/advisories/GHSA-m63x-8m98-225v","source_modified_at":"2026-10-11T23:56:32Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"other","name":"wheels"},"range":">= 4.0.0, <= 4.1.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/wheels-dev/wheels/security/advisories/GHSA-m63x-8m98-225v","source_modified_at":"2026-10-11T23:56:32Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"other","name":"wheels"},"version":"4.2.0"}],"cvss":3.7,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-11T23:56:32Z","modified_at":"2026-10-11T23:56:32Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/wheels-dev/wheels/security/advisories/GHSA-m63x-8m98-225v","fetched_at":"2026-10-25T16:01:37.004770Z","source_modified_at":"2026-10-11T23:56:32Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-11T23:56:32Z","content_hash":"8f1fbdffef809ab6dea193bc75b25aa82333458bc36f5d72123918eea31b3762"}}