CVE-2026-33183: Saloonphp/saloon Path Traversal Vulnerability

MODERATE
Advisory Identifier: GHSA-f7xc-5852-fj99
Share
CWE-125 CWE-787 CWE-22
Published
Advisory Summary

CVE-2026-33183 is a MODERATE path traversal vulnerability (CWE-125: Out-of-bounds Read) affecting Saloonphp/saloon libraries in the Packagist ecosystem. The issue involves saloon has a fixture name path traversal vulnerability. Remediation is available by upgrading affected packages to version 4.0.0.

CVE-2026-33183 at a Glance

CVE Identifier CVE-2026-33183
GHSA Identifier GHSA-f7xc-5852-fj99
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-125: Out-of-bounds Read
Affected Product Saloonphp/saloon
Package Ecosystem Packagist
Published Date
Last Updated

How to Fix CVE-2026-33183

To remediate this vulnerability, upgrade all affected Saloonphp/saloon dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

saloonphp/saloon fixed: 4.0.0 
Upgrade saloonphp/saloon to 4.0.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for saloonphp/saloon

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-33183, inspect your project dependencies for Saloonphp/saloon:

inspect dependencies for saloonphp/saloon

Analyze the terminal output to locate any version of Saloonphp/saloon in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.0.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Saloonphp/saloon, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Users with MockResponse fixtures that use path traversal. ### Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 ### Description Fixture names were used to build file paths under the configured fixture directory without validation. A name containing path segments (e.g. ../traversal or ../../etc/passwd) resulted in a path outside that directory. When the application read a fixture (e.g. for mocking) or wrote one (e.g. when recording responses), it could read or write files anywhere the process had access. If the fixture name was derived from user or attacker-controlled input (e.g. request parameters or config), this constituted a path traversal vulnerability and could lead to disclosure of sensitive files or overwriting of critical files. The fix adds validation in the fixture layer (rejecting names with /, \, .., or null bytes, and restricting to a safe character set) and defence-in-depth in the storage layer (ensuring the resolved path remains under the base directory before any read or write). ### Credits Saloon thanks @HuajiHD for finding the issue and recommending solutions and @JonPurvis for applying the fix.

CVE-2026-33183 Affected Saloonphp/saloon Versions

1 component(s)
Fixed Versions:
4.0.0
Product / Package Ecosystem Affected Versions Fixed Version
saloonphp/saloon
 Packagist
< 4.0.0
4.0.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/saloonphp/saloon/security/advisories/GHSA-f7xc-5852-fj99
NVD — CVE-2026-33183 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33183
docs.saloon.dev/upgrade/upgrading-f... WEB
https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4
Saloonphp/saloon Source Repository REPOSITORY
https://github.com/saloonphp/saloon

Frequently Asked Questions

What is CVE-2026-33183?
CVE-2026-33183 is a security vulnerability in Saloonphp/saloon involving Saloon has a Fixture Name Path Traversal Vulnerability under CWE-125: Out-of-bounds Read.
Which Saloonphp/saloon versions are affected?
Affected versions include releases prior to 4.0.0 across affected packages: saloonphp/saloon.
What version fixes CVE-2026-33183?
Upgrading to 4.0.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is saloonphp/saloon affected?
Yes, saloonphp/saloon is affected in releases prior to 4.0.0. Upgrade your dependency to 4.0.0 or later.
What CWE is associated with CVE-2026-33183?
CVE-2026-33183 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).
How can I check Packagist dependencies for CVE-2026-33183?
Run the dependency tree command: 'inspect dependencies for saloonphp/saloon'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f7xc-5852-fj99",
  "modified" : "2026-03-30T13:53:42Z",
  "published" : "2026-03-25T22:00:43Z",
  "aliases" : [ "CVE-2026-33183" ],
  "summary" : "Saloon has a Fixture Name Path Traversal Vulnerability",
  "details" : "### Impact\nUsers with MockResponse fixtures that use path traversal.\n\n### Patches\nUpgrade to Saloon v4+\n\nUpgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4\n\n### Description\nFixture names were used to build file paths under the configured fixture directory without validation. A name containing path segments (e.g. ../traversal or ../../etc/passwd) resulted in a path outside that directory. When the application read a fixture (e.g. for mocking) or wrote one (e.g. when recording responses), it could read or write files anywhere the process had access. If the fixture name was derived from user or attacker-controlled input (e.g. request parameters or config), this constituted a path traversal vulnerability and could lead to disclosure of sensitive files or overwriting of critical files. The fix adds validation in the fixture layer (rejecting names with /, \\, .., or null bytes, and restricting to a safe character set) and defence-in-depth in the storage layer (ensuring the resolved path remains under the base directory before any read or write).\n\n### Credits\nSaloon thanks @HuajiHD for finding the issue and recommending solutions and @JonPurvis for applying the fix.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "saloonphp/saloon"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.0.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/saloonphp/saloon/security/advisories/GHSA-f7xc-5852-fj99"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-33183"
  }, {
    "type" : "WEB",
    "url" : "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/saloonphp/saloon"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125", "CWE-22", "CWE-787" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-25T22:00:43Z",
    "nvd_published_at" : "2026-03-26T01:16:27Z"
  }
}