CVE-2026-63188

creationtimestamp| type| source ---|---|--- 2026-08-19 21:15:31+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mthnnlroob2x 2026-08-19 22:35:07+00:00| published-proof-of-concept| https://github.com/logto-io/logto/security/advisories/GHSA-rxjr-6c9q-h67x...

CVE-2026-63188

CVE-2026-63188 is a path traversal vulnerability in the @logto/tunnel npm package (part of Logto, an open-source auth infrastructure) affecting versions prior to 0.3.9 . When the --experience-path option is enabled, the createStaticFileProxy function passes request.url directly into path.join(sta...