CVE-2026-109823 | BDVDB-2026-396372 Detail
tidewave-aitidewave
Description#
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout. This issue affects tidewave: from 0.8.0 before 0.9.2.
Impact#
A malicious web page that a developer visits while the Phoenix development server runs can learn the developer's username, project location, and dependency layout on disk. This information helps an attacker prepare further attacks against the machine.
Weaknesses#
- CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.