CVE-2026-92812
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
Debilidad
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
Referencias
- https://github.com/decaporg/decap-cms
- https://github.com/decaporg/decap-cms/blob/11f35405cd1a1d1216e97b890173f46436752019/packages/decap-server/src/middlewares/joi/customValidators.ts#L11-L16
- https://github.com/geo-chen/oss/blob/main/decap-cms.md
- https://www.vulncheck.com/advisories/decap-server-path-traversal-via-sibling-directory-prefix-matching
Encuentra el fallo antes que un atacante.
Inicia sesión con GitHub y ejecuta tu primera auditoría en menos de un minuto. El plan gratuito no requiere tarjeta de crédito.