CVE-2026-92812
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
نوع الضعف
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
المراجع
- https://github.com/decaporg/decap-cms
- https://github.com/decaporg/decap-cms/blob/11f35405cd1a1d1216e97b890173f46436752019/packages/decap-server/src/middlewares/joi/customValidators.ts#L11-L16
- https://github.com/geo-chen/oss/blob/main/decap-cms.md
- https://www.vulncheck.com/advisories/decap-server-path-traversal-via-sibling-directory-prefix-matching
اكتشف الثغرة قبل أن يكتشفها المهاجم.
سجّل الدخول عبر GitHub وشغّل أول تدقيق لك في أقل من دقيقة. الخطة المجانية لا تتطلب بطاقة ائتمان.