From 4ea27e230244197655b178028c1e577a2fd13085 Mon Sep 17 00:00:00 2001
From: Tim Kelty <tim@craftcms.com>
Date: Thu, 28 May 2026 08:12:22 -0400
Subject: [PATCH 1/4] Resolve runtime path aliases before validating

---
 bootstrap/bootstrap.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bootstrap/bootstrap.php b/bootstrap/bootstrap.php
index cacedeae491..54d3fd24def 100644
--- a/bootstrap/bootstrap.php
+++ b/bootstrap/bootstrap.php
@@ -298,7 +298,7 @@
 }
 
 // Create the storage/runtime/ folder if it doesn't already exist
-$runtimePath = $config['runtimePath'] ?? $storagePath . DIRECTORY_SEPARATOR . 'runtime';
+$runtimePath = Craft::getAlias($config['runtimePath'] ?? $storagePath . DIRECTORY_SEPARATOR . 'runtime');
 $createFolder($runtimePath);
 $ensureFolderIsReadable($runtimePath, true);
 

From fbcf180fe28c57713e62421ab9e9850a4f90a9c8 Mon Sep 17 00:00:00 2001
From: brandonkelly <brandon@pixelandtonic.com>
Date: Thu, 28 May 2026 08:29:42 -0700
Subject: [PATCH 2/4] $config['runtimePath'] is always defined

---
 bootstrap/bootstrap.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bootstrap/bootstrap.php b/bootstrap/bootstrap.php
index 54d3fd24def..2cea0470cf2 100644
--- a/bootstrap/bootstrap.php
+++ b/bootstrap/bootstrap.php
@@ -297,8 +297,8 @@
     craft_modify_app_config($config, $appType);
 }
 
-// Create the storage/runtime/ folder if it doesn't already exist
-$runtimePath = Craft::getAlias($config['runtimePath'] ?? $storagePath . DIRECTORY_SEPARATOR . 'runtime');
+// Create the runtime folder if it doesn't already exist
+$runtimePath = Craft::getAlias($config['runtimePath']);
 $createFolder($runtimePath);
 $ensureFolderIsReadable($runtimePath, true);
 

From 0c36edbab6661c3c0de6e9d0e0eafac817d54548 Mon Sep 17 00:00:00 2001
From: brandonkelly <brandon@pixelandtonic.com>
Date: Thu, 28 May 2026 08:31:21 -0700
Subject: [PATCH 3/4] Release note

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9bd720f923e..210d154bc67 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Release Notes for Craft CMS 5
 
+## Unreleased
+
+- Fixed a bug where the runtime path wasn’t getting set correctly. ([#18986](https://github.com/craftcms/cms/pull/18986))
+
 ## 5.10.4 - 2026-05-27
 
 - Updated Twig to 3.27. ([#18980](https://github.com/craftcms/cms/pull/18980))

From b2f1fea4bee4cf0abf02228d05b215ee7f61139f Mon Sep 17 00:00:00 2001
From: brandonkelly <brandon@pixelandtonic.com>
Date: Thu, 28 May 2026 08:35:58 -0700
Subject: [PATCH 4/4] Tweak the release note

[ci skip]
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 210d154bc67..23bdf4f1bdc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## Unreleased
 
-- Fixed a bug where the runtime path wasn’t getting set correctly. ([#18986](https://github.com/craftcms/cms/pull/18986))
+- Fixed a bug where an empty `@storage/runtime` directory could be created within the webroot. ([#18986](https://github.com/craftcms/cms/pull/18986))
 
 ## 5.10.4 - 2026-05-27