Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111448

Quick assessment

Affected
Wheels Wheels
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wheels 4.0.0 至 4.1.2 版本在区分大小写的文件系统上，对路径包含检查使用了不区分大小写的比较方式。针对 ZIP 条目、包映射、开发资源/文档、指南图片及图片标签的规范路径检查，可能通过现有符号链接访问一个大小写不同的兄弟目录，从而允许访问预期根目录之外的区域，导致有限的文件泄露。此外，CLI 的数据库转储输出检查功能可能将数据写入到应用根目录之外的大小写不同的现有可写兄弟目录中；该操作需要同时满足 CLI POST 请求、回环（loopback）连接以及密码验证等条件。此问题已在 4.2.0 版本

CVSS 3.7 · Low EPSS 0.21% · P10

Affected Version Matrix 1

VendorProduct Version RangeStatus
Wheels Wheels 4.0.0< 4.2.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111448

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory, allowing access outside the intended root, including limited file disclosure. Separately, the CLI database-dump output check can write outside the application root to an existing writable case-distinct sibling directory; that action requires the CLI POST, loopback and password gate. This is fixed in 4.2.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Wheels Wheels 4.0.0 ~ 4.2.0 -

II. Public POCs for CVE-2026-111448

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111448

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-111448 (1)

Same Patch Batch · Wheels · 2026-10-16 · 9 CVEs total

CVE-2026-111444 9.8 CRITICAL Wheels 4.1.2 存在 SQL 注入漏洞
CVE-2026-111446 8.6 HIGH Wheels 4.0.0-4.1.2 未授权访问漏洞
CVE-2026-111445 8.1 HIGH Wheels 4.0.0-4.1.2 存在越权漏洞
CVE-2026-111447 8.1 HIGH Wheels 4.1.2 嵌套表单任意更新删除漏洞
CVE-2026-111451 7.8 HIGH Wheels CLI 4.0.0-4.1.1 远程代码执行与文件覆盖漏洞
CVE-2026-111443 6.5 MEDIUM Wheels 4.0.6-4.1.2 上下文切换漏洞
CVE-2026-111450 5.9 MEDIUM Wheels 4.1.1 冷启动 Host 头漏洞致信息泄露
CVE-2026-111449 5.9 MEDIUM Wheels 4.1.1 之前版本存在敏感信息泄露漏洞

IV. Related Vulnerabilities

Same product: Wheels
Same vendor: Wheels
Same weakness: CWE-178

V. Comments for CVE-2026-111448

No comments yet

Leave a comment