Craft CMS vulnerable to Remote Code Execution via validatePath bypass

A path validation flaw in Craft CMS (versions 3.0.0–3.8.14 and 4.0.0-RC1–4.4.14) allows authenticated users with the ALLOW_ADMIN_CHANGES=true configuration to bypass the validatePath function [1][2]. The vulnerability arises because the system paths in bootstrap.php are validated against a simple path format (/path1/path2), but a file URI scheme like file:///path1/path2 can bypass this check. The mkdir() function in PHP natively supports the file scheme, enabling the creation of directories outside the intended system paths [2].

To exploit this, an attacker must first authenticate to the Craft control panel, and the application must have ALLOW_ADMIN_CHANGES set to true. By crafting a request that uses a file:// URI instead of a standard Unix path, an attacker can write files or directories to arbitrary locations on the server filesystem [2]. This bypasses the path validation that is meant to confine operations to system directories such as config/, storage/, and templates/ [2].

The impact is remote code execution, as the attacker can place a malicious PHP file (e.g., a web shell) in a web-accessible directory and then execute it through the Craft application [1][2]. The advisory notes that this poses a serious security threat, potentially leading to full control of the vulnerable system and data exfiltration [1][2].

Both Craft CMS 3.x and 4.x lines have been patched in versions 3.8.15 and 4.4.15, respectively [1][2][3][4]. Users are strongly advised to upgrade to these or later versions. There is no workaround aside from applying the patch; however, restricting access to the control panel and disabling ALLOW_ADMIN_CHANGES where possible can reduce exposure.