CVE-2026-33183

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33183", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T22:16:36.720Z", "datePublished": "2026-03-26T00:25:53.838Z", "dateUpdated": "2026-03-26T18:21:32.435Z"}, "containers": {"cna": {"title": "Saloon has a Fixture Name Path Traversal Vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/saloonphp/saloon/security/advisories/GHSA-f7xc-5852-fj99", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/saloonphp/saloon/security/advisories/GHSA-f7xc-5852-fj99"}, {"name": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4", "tags": ["x_refsource_MISC"], "url": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4"}], "affected": [{"vendor": "saloonphp", "product": "saloon", "versions": [{"version": "< 4.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T00:27:36.804Z"}, "descriptions": [{"lang": "en", "value": "Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, fixture names were used to build file paths under the configured fixture directory without validation. A name containing path segments (e.g. ../traversal or ../../etc/passwd) resulted in a path outside that directory. When the application read a fixture (e.g. for mocking) or wrote one (e.g. when recording responses), it could read or write files anywhere the process had access. If the fixture name was derived from user or attacker-controlled input (e.g. request parameters or config), this constituted a path traversal vulnerability and could lead to disclosure of sensitive files or overwriting of critical files. The fix in version 4.0.0 adds validation in the fixture layer (rejecting names with /, \\, .., or null bytes, and restricting to a safe character set) and defense-in-depth in the storage layer (ensuring the resolved path remains under the base directory before any read or write)."}], "source": {"advisory": "GHSA-f7xc-5852-fj99", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T18:21:24.081020Z", "id": "CVE-2026-33183", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:21:32.435Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33183", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-26T18:21:24.081020Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:21:28.912Z"}}], "cna": {"title": "Saloon has a Fixture Name Path Traversal Vulnerability", "source": {"advisory": "GHSA-f7xc-5852-fj99", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "saloonphp", "product": "saloon", "versions": [{"status": "affected", "version": "< 4.0.0"}]}], "references": [{"url": "https://github.com/saloonphp/saloon/security/advisories/GHSA-f7xc-5852-fj99", "name": "https://github.com/saloonphp/saloon/security/advisories/GHSA-f7xc-5852-fj99", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4", "name": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, fixture names were used to build file paths under the configured fixture directory without validation. A name containing path segments (e.g. ../traversal or ../../etc/passwd) resulted in a path outside that directory. When the application read a fixture (e.g. for mocking) or wrote one (e.g. when recording responses), it could read or write files anywhere the process had access. If the fixture name was derived from user or attacker-controlled input (e.g. request parameters or config), this constituted a path traversal vulnerability and could lead to disclosure of sensitive files or overwriting of critical files. The fix in version 4.0.0 adds validation in the fixture layer (rejecting names with /, \\, .., or null bytes, and restricting to a safe character set) and defense-in-depth in the storage layer (ensuring the resolved path remains under the base directory before any read or write)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T00:27:36.804Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33183", "state": "PUBLISHED", "dateUpdated": "2026-03-26T18:21:32.435Z", "dateReserved": "2026-03-17T22:16:36.720Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T00:25:53.838Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "saloon", "vendor": "saloonphp", "versions": [{"status": "affected", "version": "< 4.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:saloon:saloon:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DA20E08-DBB0-4ACD-BED9-550F3ED97E3D", "versionEndExcluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, fixture names were used to build file paths under the configured fixture directory without validation. A name containing path segments (e.g. ../traversal or ../../etc/passwd) resulted in a path outside that directory. When the application read a fixture (e.g. for mocking) or wrote one (e.g. when recording responses), it could read or write files anywhere the process had access. If the fixture name was derived from user or attacker-controlled input (e.g. request parameters or config), this constituted a path traversal vulnerability and could lead to disclosure of sensitive files or overwriting of critical files. The fix in version 4.0.0 adds validation in the fixture layer (rejecting names with /, \\, .., or null bytes, and restricting to a safe character set) and defense-in-depth in the storage layer (ensuring the resolved path remains under the base directory before any read or write)."}, {"lang": "es", "value": "Saloon es una biblioteca de PHP que ofrece a los usuarios herramientas para crear integraciones de API y SDK. Antes de la versi\u00f3n 4.0.0, los nombres de los fixtures se utilizaban para generar rutas de archivo dentro del directorio de fixtures configurado sin validaci\u00f3n. Un nombre que contuviera segmentos de ruta (por ejemplo, ../traversal o ../../etc /passwd) daba lugar a una ruta fuera de dicho directorio. Cuando la aplicaci\u00f3n le\u00eda un fixture (por ejemplo, para simulaci\u00f3n) o escrib\u00eda uno (por ejemplo, al registrar respuestas), pod\u00eda leer o escribir archivos en cualquier lugar al que el proceso tuviera acceso. Si el nombre del fixture se derivaba de una entrada controlada por el usuario o por un atacante (por ejemplo, par\u00e1metros de solicitud o configuraci\u00f3n), esto constitu\u00eda una vulnerabilidad de traversal de ruta y pod\u00eda dar lugar a la divulgaci\u00f3n de archivos confidenciales o a la sobrescritura de archivos cr\u00edticos. La correcci\u00f3n en la versi\u00f3n 4.0.0 a\u00f1ade validaci\u00f3n en la capa de fixtures (rechazando nombres con /, \\, .. o bytes nulos, y restringi\u00e9ndolos a un conjunto de caracteres seguro) y defensa en profundidad en la capa de almacenamiento (asegurando que la ruta resuelta permanezca bajo el directorio base antes de cualquier lectura o escritura)."}], "id": "CVE-2026-33183", "lastModified": "2026-06-17T10:37:05.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33183", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T18:21:24.081020Z", "version": "2.0.3"}}]}, "published": "2026-03-26T01:16:27.210", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/saloonphp/saloon/security/advisories/GHSA-f7xc-5852-fj99"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "saloon", "source": "cna", "vendor": "saloonphp"}, "product": "saloon", "vendor": "saloonphp"}], "analysis": {"en": {"generated_at": "2026-03-30T18:30:02.712750+00:00", "value": {"mitigation_remediation": ["Upgrade Saloon to version 4.0.0 or later.", "If an upgrade is not immediately possible, restrict fixture handling to trusted inputs or disable it for user\u2011controlled data.", "Verify that the fixture directory resides in a location not exposed to the web and that file write operations are restricted to that directory."], "summary": {"action": "Immediate Patch", "impact": "Data Disclosure & File Modification"}, "threat_synthesis": {"affected_systems": "The issue affects saloonphp:saloon products for all releases prior to 4.0.0. There is no narrower version restriction listed; therefore any version from the earliest releases up to 3.x is vulnerable. The vendor recommends upgrading to version\u00a04.0.0\u00a0or later, where input validation and path checking have been added to the fixture layer.", "description_and_impact": "Saloon, a PHP library used for API integrations, contains a path traversal flaw in its fixture handling logic. Before version\u00a04.0.0 the system accepted fixture names directly as file path components. An attacker who could influence the fixture name, such as through request parameters or configuration values, could inject path segments like\u00a0../\u00a0or\u00a0../../etc/passwd. This allows reading arbitrary files or writing files wherever the PHP process has permission. The flaw maps to CWE\u201122 and poses a threat to confidentiality and integrity.", "risk_and_exploitability": "The CVSS score of\u00a08.0\u00a0indicates high severity, while the EPSS score of less than\u00a01% suggests a low probability of exploitation in the wild. The vulnerability is not catalogued in CISA KEV. Attackers would need to supply a crafted fixture name with a user\u2011controlled source; thus the vector is likely application\u2011level, possibly via an API endpoint exposing new fixtures or legacy configuration files. The confirmed risk is that an adversary could read sensitive system files or overwrite configuration and code files, potentially leading to compromise of the application or further lateral movement."}}}}, "created": "2026-03-26T11:30:55.697581+00:00", "updated": "2026-03-30T20:57:45.673621+00:00", "vendors": ["saloonphp", "saloonphp$PRODUCT$saloon"]}