Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-33183

29
FAUCET Score

CVE-2026-33183 identifies a critical path traversal vulnerability in the Saloon PHP library, affecting versions prior to 4.0.0. This flaw allows an unauthenticated attacker to read or write files anywhere the process has access, potentially leading to high confidentiality and integrity impacts if user-controlled input is used for fixture names. Rated 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), it has a network attack vector with low attack complexity and requires no privileges or user interaction. There is currently no evidence of active exploitation, and no public exploit code or significant community discussion has been identified.

Impacted Technologies

VendorProductVersion(s)CPE
< 4.0.0CPE matchmatch criteria
cpe:2.3:a:saloon:saloon:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

8.0HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
UNREPORTED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.57%
Probability of exploitation in next 30 days
EPSS Percentile
43.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0057 is in the 23rd percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

composerpatch availablevia ghsa
Product: saloonphp/saloonFixed in: 4.0.0
github_advisoryvendor investigatingvia nvd_reference
View patch

Vendor Advisories (1)

composerGHSA-f7xc-5852-fj99medium

Saloon has a Fixture Name Path Traversal Vulnerability

Mar 25, 2026

References

docs.saloon.dev / upgrade/upgrading-from-v3-to-v4
Release Notes
github.com / saloonphp/saloon/security/advisories/GHSA-f7xc-5852-fj99
Vendor Advisory