CVEs

CVE-2026-92812 - Decap-CMS 3.11.0 Path traversal Overvie...

CVE-2026-92812

Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete...

@kcws/astro-decap-cms (>=0.7.0, <=0.31.0) potentially affected by CVE-2026-92812 via decap-server (>=3.0.4, <=3.1.2)

decap-server NPM version =3.0.4, =0.7.0, =0.31.0 Source cves: CVE-2026-92812 Source advisory: MEND:CVE-2026-92812...

CVE-2026-92812

The decap-server component (used in Decap CMS ) contains a path traversal vulnerability in its local proxy containment guard. The root cause is the use of plain string prefix comparison without proper path separator validation. This flaw allows attackers to access sibling directories whose names ...

EUVD-2026-81070

decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outsi...

CVE-2026-92812 Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching

Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete...

CVE-2026-92812

decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outsi...

CVE-2026-92812 decap-server Path Traversal via Sibling Directory Prefix Matching

decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outsi...

CVE-2026-92812 Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching

Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete...

CVE-2026-92812: Improper Limitation of a Pathname to a Restricted Directory

Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete...

PT-2026-94084

Name of the Vulnerable Software and Affected Versions decap-server affected versions not specified Description A path traversal issue exists in the local proxy containment guard. The system employs plain string prefix comparison without validating path separators, allowing attackers to access...