Saloon has a Fixture Name Path Traversal Vulnerability

published 2026-03-25 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-16060 , GHSA-f7xc-5852-fj99

cvss: 9.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits: 0; none known

Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, fixture names were used to build file paths under the configured fixture directory without validation. A name containing path segments (e.g. ../traversal or ../../etc/passwd) resulted in a path outside that directory. When the application read a fixture (e.g. for mocking) or wrote one (e.g. when recording responses), it could read or write files anywhere the process had access. If the fixture name was derived from user or attacker-controlled input (e.g. request parameters or config), this constituted a path traversal vulnerability and could lead to disclosure of sensitive files or overwriting of critical files. The fix in version 4.0.0 adds validation in the fixture layer (rejecting names with /, \, .., or null bytes, and restricting to a safe character set) and defense-in-depth in the storage layer (ensuring the resolved path remains under the base directory before any read or write).

Patch / fix

fixed in 2

packagist saloonphp/saloon 4.0.0
saloon saloon 4.0.0

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 7 mo ago (2026-03-26)

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
CNA	4.0	8.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	saloonphp/saloon	<4.0.0	4.0.0

Affected products

saloonphp saloon

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-125 Out-of-bounds Read
CWE-787 Out-of-bounds Write

References

github.com /saloonphp/saloon/security/advisories/GHSA-f7xc-5852-fj99
web, vendor-advisory
docs.saloon.dev /upgrade/upgrading-from-v3-to-v4
web, release-notes
nvd.nist.gov /vuln/detail/CVE-2026-33183
advisory
github.com /saloonphp/saloon
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary