CVE-2026-111448

🗓️ 16 Oct 2026 03:41:58Reported by mitreType

cve🔗 web.nvd.nist.gov👁 28 Views🌐 WEB

Case-insensitive path checks in Wheels allow limited file disclosure and path traversal.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-111448	16 Oct 202603:57	–	circl
CNNVD	WHEELS.DEV: Wheel	15 Oct 202616:00	–	cnnvd
Cvelist	CVE-2026-111448	16 Oct 202603:41	–	cvelist
EUVD	EUVD-2026-102601	16 Oct 202603:41	–	euvd
Mend	CVE-2026-111448	16 Oct 202603:41	–	mend
NVD	CVE-2026-111448	16 Oct 202604:18	–	nvd
Positive Technologies	PT-2026-115411	16 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-111448: Improper Handling of Case Sensitivity	16 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-111448	16 Oct 202603:41	–	vulnrichment

[
  {
    "defaultStatus": "unaffected",
    "product": "Wheels",
    "repo": "https://github.com/wheels-dev/wheels",
    "vendor": "Wheels",
    "versions": [
      {
        "lessThan": "4.2.0",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/wheels-dev/wheels/security/advisories/GHSA-m63x-8m98-225v

Parameter	Position	Path	Description	CWE
zip entries	path	/zip	Path-containment check for zip entries uses case-insensitive comparisons on case-sensitive filesystems, allowing access via symlinks to case-distinct sibling directories.	CWE-178
package mappings	path	/package	Path-containment check for package mappings uses case-insensitive comparisons on case-sensitive filesystems, allowing access via symlinks to case-distinct sibling directories.	CWE-178
development assets/docs	path	/development	Path-containment check for development assets/docs uses case-insensitive comparisons on case-sensitive filesystems, allowing access via symlinks to case-distinct sibling directories.	CWE-178
guide images	path	/guide	Path-containment check for guide images uses case-insensitive comparisons on case-sensitive filesystems, allowing access via symlinks to case-distinct sibling directories.	CWE-178
image tags	path	/image	Path-containment check for image tags uses case-insensitive comparisons on case-sensitive filesystems, allowing access via symlinks to case-distinct sibling directories.	CWE-178

16 Oct 2026 15:19Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.13.7

EPSS0.00208

SSVC

CWE-178