CVE-2026-111448

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...

CVE-2026-111448

Wheels versions 4.0.0 through 4.1.2 are vulnerable to a path containment flaw because they use case-insensitive comparisons on case-sensitive filesystems. This allows an attacker to use an existing symlink to a case-distinct sibling directory to bypass checks for zip entries, package mappings, de...

EUVD-2026-102601

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...