CVE-2026-66653

This CVE exposes a structural failure that should change how you think about LFI vulnerabilities in your codebase. The key insight isn't the vulnerability itself — path traversal in file-inclusion logic is a well-known class — but the fact that it lives in an unauthenticated, internet-facing endpoint. That detail tells you something critical: someone placed file-inclusion logic at the network perimeter under an assumption that upstream controls would handle sanitization. They were wrong, or those controls never existed, and the result is a vulnerability reachable by anyone with network access. The multiple patch iterations in version 2.5.1 compound the problem. Each incomplete patch does two things: it reveals the sanitization logic to every scanner and attacker observing the diff, and it creates a breadcrumb trail showing that the root cause was never fully addressed. You're not looking at a single buggy fix — you're looking at a pattern where surface-level corrections were applied to a fundamentally unsafe design, likely by different developers over time who didn't understand why the previous patches existed. This is institutional memory failure in action. Your priority: audit any file-inclusion, file-upload, or path-handling functionality that operates without authentication. Check whether it was designed for internal use and accidentally exposed, or placed at the perimeter with implicit trust in upstream routing. The question isn't just 'does this endpoint accept user input as a file path' — it's 'why was this functionality ever reachable without authentication, and what assumptions about the deployment topology made that seem reasonable at the time?' If you're maintaining similar tooling, treat every file-inclusion feature as a candidate for allowlisting, not sanitization. The dangerous default — accepting arbitrary paths — requires zero work. The secure implementation requires active decisions about scope, validation, and boundaries. No linter will flag the insecure pattern by default; you have to design around it.

Reviewed through automated stages and approved by a human before publication.