CVE-2026-49144

🗓️ 02 Jun 2026 20:34:54Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 16 Views

Path traversal flaw in BrowserStack Runner up to 0.9.5 via the web server handler allows unauthenticated access to arbitrary files.

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2026-49144	2 Jun 202620:34	–	attackerkb
Circl	CVE-2026-49144	3 Jun 202621:38	–	circl
CNNVD	BrowserStack Runner 路径遍历漏洞	2 Jun 202600:00	–	cnnvd
Cvelist	CVE-2026-49144 BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler	2 Jun 202620:34	–	cvelist
EUVD	EUVD-2026-34031	3 Jun 202621:38	–	euvd
Github Security Blog	browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server	3 Jun 202621:38	–	github
NVD	CVE-2026-49144	2 Jun 202621:16	–	nvd
OSV	GHSA-8RPW-6CQH-2V9H browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server	3 Jun 202621:38	–	osv
Positive Technologies	PT-2026-46088	3 Jun 202600:00	–	ptsecurity
Positive Technologies	PT-2026-6334	3 Feb 202600:00	–	ptsecurity

Vulners

Node

browserstack browserstack-runnerRange0–0.9.5

[
  {
    "defaultStatus": "affected",
    "vendor": "browserstack",
    "product": "browserstack-runner",
    "repo": "https://github.com/browserstack/browserstack-runner",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "0.9.5"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/browserstack-runner-path-traversal-via-default-http-handler
github	www.github.com/browserstack/browserstack-runner/security/advisories/GHSA-8rpw-6cqh-2v9h

17 Jun 2026 10:55Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5

CVSS 47.1

EPSS0.00207

SSVC

CWE-22