https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:54:51 +0000 https://db.gcve.eu/vuln/cve-2026-86251 <p><strong>Affected:</strong> h3js h3</p> <p>h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal &#39;.&#39; characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as &#39;..&#39; per RFC 3986, enabling path traversal to read arbitrary files from the backend.</p> <p><strong>Affected:</strong> h3js h3</p> <p>h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal &#39;.&#39; characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as &#39;..&#39; per RFC 3986, enabling path traversal to read arbitrary files from the backend.</p> https://db.gcve.eu/vuln/cve-2026-86251