CVE-2026-33183 is a path traversal in Saloon, a PHP library for building API integrations. NVD scores it 9.1 critical, though the project advisory rates it Low. Before 4.0.0, fixture names were not validated. Upgrade saloonphp/saloon to 4.0.0 and check how fixture names are built.
What's affected
All Saloon releases before 4.0.0, installed through Composer as saloonphp/saloon. The patched version is 4.0.0.
Per the advisory (GHSA-f7xc-5852-fj99), the impact is on users whose MockResponse fixtures use names that can include path traversal, for example names taken from request parameters or configuration.
How to check if you're exposed
Find the installed version:
composer show saloonphp/saloon
Then search your code for fixture usage and look at where the name comes from. A fixed string in a test is not a problem. A name built from user input or external config is.
What to do now
- Upgrade to Saloon 4.0.0 with composer update saloonphp/saloon. The upgrade guide notes that v4 shipped as a security release and has breaking changes, so read it first.
- Make sure no fixture name comes from user controlled input.
- Run your tests and check that fixtures still resolve to the expected directory.
- If you ever recorded fixtures from user driven names, check the file system for unexpected files outside the fixture directory.
Why it matters
The weakness is CWE-22, path traversal. The advisory says names with path segments could resolve outside the configured fixture directory, so the process could read or write any file it had access to. That can mean disclosure of sensitive files or overwriting of important ones.
The fix rejects names containing slashes, backslashes, parent directory segments or null bytes, limits names to a safe character set, and also checks that the resolved path stays under the base directory. The advisory's Low rating reflects that most apps never feed user input into fixture names. The record does not mark this CVE as listed in CISA KEV.
Quick check
Why do the NVD and project ratings differ?
NVD scores the worst case, where a name is attacker controlled. The project rates Low because fixtures are mostly a testing feature with fixed names. Your own risk depends on how you use them.
Sources
Last reviewed: 19 October 2026.
