CVE-2026-92812 decap-server Path Traversal via Sibling Directory Prefix Matching

🗓️ 16 Sep 2026 20:32:58Reported by VulnCheckType

decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository di...

Reporter	Title	Published	Views	Family All 3
CVE	CVE-2026-92812	16 Sep 202620:32	–	cve
EUVD	EUVD-2026-81070	16 Sep 202620:32	–	euvd
NVD	CVE-2026-92812	16 Sep 202621:17	–	nvd

[
  {
    "vendor": "decaporg",
    "product": "decap-server",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "11f35405cd1a1d1216e97b890173f46436752019",
        "status": "affected",
        "versionType": "git"
      }
    ]
  }
]

Source	Link
github	www.github.com/decaporg/decap-cms
github	www.github.com/decaporg/decap-cms/blob/11f35405cd1a1d1216e97b890173f46436752019/packages/decap-server/src/middlewares/joi/customValidators.ts
github	www.github.com/geo-chen/oss/blob/main/decap-cms.md
vulncheck	www.vulncheck.com/advisories/decap-server-path-traversal-via-sibling-directory-prefix-matching

16 Sep 2026 20:32Current

CVSS 3.16.8

CVSS 47.6

CWE-22