CVE-2026-92812 | BDVDB-2026-375521 Detail
decaporgdecap-cms
Description#
Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References#
- https://github.com/decaporg/decap-cms/security/advisories/GHSA-5rrq-v82w-qpfr
- https://github.com/geo-chen/oss/blob/main/decap-cms.md
- https://github.com/decaporg/decap-cms/releases?page=2#release-decap-cms@3.11.0
- https://www.vulncheck.com/advisories/decap-cms-path-traversal-via-sibling-directory-prefix-matching
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.