EUVD-2026-118494

esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal...

GHSA-G3C2-RJQ2-C763 esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal

Summary The documented web.NewHandler static file server can read files outside Config.AppDir when the request path contains URL-encoded dot-segments such as %2e%2e. Go's ServeMux redirects plain /../ paths, but it passes encoded dot-segments to the handler after decoding r.URL.Path. The handler...

esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal

Summary The documented web.NewHandler static file server can read files outside Config.AppDir when the request path contains URL-encoded dot-segments such as %2e%2e. Go's ServeMux redirects plain /../ paths, but it passes encoded dot-segments to the handler after decoding r.URL.Path. The handler...

CVE-2026-102657

esm.sh is a no-build content delivery network CDN for web development. Prior to server version 1377, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application...

CVE-2026-102657 esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal

esm.sh is a no-build content delivery network CDN for web development. Prior to server version 1377, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application...

CVE-2026-102657 esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal

esm.sh is a no-build content delivery network CDN for web development. Prior to server version 1377, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application...

CVE-2026-102657

The esm.sh content delivery network (CDN) is vulnerable to a path traversal issue in its web.NewHandler static file server (located in web/handler.go). The root cause is the failure to verify that the joined URL-decoded r.URL.Path and Config.AppDir remain within the configured application directo...

CVE-2026-102657

esm.sh is a no-build content delivery network CDN for web development. Prior to server version 1377, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application...

PT-2026-138438

Name of the Vulnerable Software and Affected Versions esm.sh versions prior to 137 7 Description The web.NewHandler static file server in web/handler.go fails to verify that the result of joining the URL-decoded r.URL.Path with Config.AppDir remains within the configured application directory. An...

esm.sh path traversal vulnerability

Versions of esm.sh prior to 1377 contain a path traversal vulnerability. This vulnerability arises because the web.NewHandler static file server fails to validate whether the concatenation of URL decoded r.URL.Path and Config.AppDir results within the configured application directory. The...

CVE-2026-102657: esm-dev esm.sh: esm.sh is a no-build content delivery network (CDN) for web development

esm.sh is a no-build content delivery network CDN for web development. Prior to server version 1377, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application...