Vulnerability-Lookup

GHSA-7G7C-H8RR-7P6Q

Vulnerability from github – Published: 2026-10-05 22:53 – Updated: 2026-10-05 22:53

Summary

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

Details

A Path Traversal vulnerability exists in the prerendered (SSG) page retrieval logic of CommonEngine in @angular/ssr/node (and @angular/ssr in earlier versions). When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serve prerendered pages from sibling output directories.

The vulnerability occurs due to how relative URLs and Windows file paths are resolved and validated:

A request URL containing a backslash parent traversal segment (e.g., /..\app-admin) is passed to CommonEngine.render({ url }).
The engine parses the URL using new URL(url, 'resolve://'). Because resolve:// is a non-special scheme under the WHATWG URL standard, backslashes are not normalized to forward slashes, leaving the pathname unnormalized as /..\app-admin.
The engine constructs the candidate file path using join(publicPath, pathname, 'index.html'). On Windows, path.join treats \ as a path delimiter, resolving the parent segment (..\) out of publicPath (e.g., dist\app) into a sibling directory (e.g., dist\app-admin\index.html).
The containment check (pagePath.startsWith(normalize(publicPath))) performs a prefix match without a trailing path delimiter. Because the sibling folder name starts with the configured public folder name (e.g., dist\app-admin starts with dist\app), the check erroneously succeeds.
If the target file exists and contains the Angular SSG marker (ng-server-context="...ssg..."), CommonEngine reads and serves the sibling page instead of rendering the requested route.

Impact

This vulnerability allows unauthorized access to prerendered static pages from adjacent applications or build outputs:

Information Disclosure: Prerendered HTML pages located in sibling directories sharing the same name prefix as the public directory (e.g., an internal administration app app-admin adjacent to app) can be accessed by unauthorized users.
Limited Scope: Only HTML files matching the Angular SSG marker regex are served. Arbitrary non-Angular files, secrets, or configuration files without the SSG context attribute cannot be read through this mechanism.

Attack Preconditions

The application must use CommonEngine from @angular/ssr/node (or @angular/ssr in v17–v18).
The application must be hosted on Windows (where Node's path.join resolves \ as a path separator).
The application passes a relative request URL (such as req.url or req.originalUrl without origin) into CommonEngine.render({ url }).
A sibling directory exists whose name starts with the same prefix as the configured publicPath directory (e.g., dist\app-admin alongside dist\app).
The targeted sibling directory contains prerendered HTML output containing the Angular SSG marker.

Affected Versions

>= 22.0.0, < 22.1.7
>= 21.0.0, < 21.2.23
>= 20.0.0, < 20.3.36
<= 19.2.27

Patches

22.1.7
21.2.23
20.3.36

Versions <= 19.2.27 have reached End of Support / LTS expiration and will not be patched.

Workarounds

Until a patch is applied, developers using CommonEngine on Windows can sanitize request URLs in server.ts before passing them to CommonEngine.render, ensuring backslashes are replaced or that an absolute HTTP URL is constructed:

server.use((req, res, next) => {
  const { protocol, originalUrl, headers } = req;

  // Normalize backslashes or construct a full HTTP URL (which forces WHATWG URL normalization)
  const sanitizedUrl = `${protocol}://${headers.host}${originalUrl.replace(/\\/g, '/')}`;

  commonEngine
    .render({
      bootstrap,
      documentFilePath: indexHtml,
      url: sanitizedUrl,
      publicPath: distFolder,
    })
    .then((html) => res.send(html))
    .catch((err) => next(err));
});

Alternatively, migrate from the deprecated CommonEngine to AngularNodeAppEngine, which relies on manifest-based route matching rather than direct filesystem path resolution.

Severity

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/ssr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "22.0.0"
            },
            {
              "fixed": "22.1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/ssr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "21.0.0"
            },
            {
              "fixed": "21.2.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/ssr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "20.0.0"
            },
            {
              "fixed": "20.3.36"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/ssr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "19.2.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-104871"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:53:45Z",
    "nvd_published_at": "2026-10-02T20:17:00Z",
    "severity": "MODERATE"
  },
  "details": "A Path Traversal vulnerability exists in the prerendered (SSG) page retrieval logic of `CommonEngine` in `@angular/ssr/node` (and `@angular/ssr` in earlier versions). When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes `CommonEngine` to serve prerendered pages from sibling output directories.\n\nThe vulnerability occurs due to how relative URLs and Windows file paths are resolved and validated:\n\n1. A request URL containing a backslash parent traversal segment (e.g., `/..\\app-admin`) is passed to `CommonEngine.render({ url })`.\n2. The engine parses the URL using `new URL(url, \u0027resolve://\u0027)`. Because `resolve://` is a non-special scheme under the WHATWG URL standard, backslashes are not normalized to forward slashes, leaving the `pathname` unnormalized as `/..\\app-admin`.\n3. The engine constructs the candidate file path using `join(publicPath, pathname, \u0027index.html\u0027)`. On Windows, `path.join` treats `\\` as a path delimiter, resolving the parent segment (`..\\`) out of `publicPath` (e.g., `dist\\app`) into a sibling directory (e.g., `dist\\app-admin\\index.html`).\n4. The containment check (`pagePath.startsWith(normalize(publicPath))`) performs a prefix match without a trailing path delimiter. Because the sibling folder name starts with the configured public folder name (e.g., `dist\\app-admin` starts with `dist\\app`), the check erroneously succeeds.\n5. If the target file exists and contains the Angular SSG marker (`ng-server-context=\"...ssg...\"`), `CommonEngine` reads and serves the sibling page instead of rendering the requested route.\n\n### Impact\n\nThis vulnerability allows unauthorized access to prerendered static pages from adjacent applications or build outputs:\n\n- **Information Disclosure:** Prerendered HTML pages located in sibling directories sharing the same name prefix as the public directory (e.g., an internal administration app `app-admin` adjacent to `app`) can be accessed by unauthorized users.\n- **Limited Scope:** Only HTML files matching the Angular SSG marker regex are served. Arbitrary non-Angular files, secrets, or configuration files without the SSG context attribute cannot be read through this mechanism.\n\n### Attack Preconditions\n\n- The application must use `CommonEngine` from `@angular/ssr/node` (or `@angular/ssr` in v17\u2013v18).\n- The application must be hosted on Windows (where Node\u0027s `path.join` resolves `\\` as a path separator).\n- The application passes a relative request URL (such as `req.url` or `req.originalUrl` without origin) into `CommonEngine.render({ url })`.\n- A sibling directory exists whose name starts with the same prefix as the configured `publicPath` directory (e.g., `dist\\app-admin` alongside `dist\\app`).\n- The targeted sibling directory contains prerendered HTML output containing the Angular SSG marker.\n\n### Affected Versions\n\n- `\u003e= 22.0.0, \u003c 22.1.7`\n- `\u003e= 21.0.0, \u003c 21.2.23`\n- `\u003e= 20.0.0, \u003c 20.3.36`\n- `\u003c= 19.2.27`\n\n### Patches\n\n- `22.1.7`\n- `21.2.23`\n- `20.3.36`\n\n\u003e Versions `\u003c= 19.2.27` have reached End of Support / LTS expiration and will not be patched.\n\n### Workarounds\n\nUntil a patch is applied, developers using `CommonEngine` on Windows can sanitize request URLs in `server.ts` before passing them to `CommonEngine.render`, ensuring backslashes are replaced or that an absolute HTTP URL is constructed:\n\n```ts\nserver.use((req, res, next) =\u003e {\n  const { protocol, originalUrl, headers } = req;\n\n  // Normalize backslashes or construct a full HTTP URL (which forces WHATWG URL normalization)\n  const sanitizedUrl = `${protocol}://${headers.host}${originalUrl.replace(/\\\\/g, \u0027/\u0027)}`;\n\n  commonEngine\n    .render({\n      bootstrap,\n      documentFilePath: indexHtml,\n      url: sanitizedUrl,\n      publicPath: distFolder,\n    })\n    .then((html) =\u003e res.send(html))\n    .catch((err) =\u003e next(err));\n});\n```\n\nAlternatively, migrate from the deprecated `CommonEngine` to `AngularNodeAppEngine`, which relies on manifest-based route matching rather than direct filesystem path resolution.",
  "id": "GHSA-7g7c-h8rr-7p6q",
  "modified": "2026-10-05T22:53:45Z",
  "published": "2026-10-05T22:53:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104871"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/angular/angular-cli"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular-cli/releases/tag/v20.3.36"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular-cli/releases/tag/v21.2.23"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular-cli/releases/tag/v22.1.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows"
}

CVE-2026-104871 (GCVE-0-2026-104871)

Vulnerability from cvelistv5 – Published: 2026-10-02 19:43 – Updated: 2026-10-02 20:12

Title

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

Summary

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 20:12 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

8 references

URL	Tags
https://github.com/angular/angular-cli/security/a…	x_refsource_CONFIRM
https://github.com/angular/angular-cli/commit/645…	x_refsource_MISC
https://github.com/angular/angular-cli/commit/707…	x_refsource_MISC
https://github.com/angular/angular-cli/commit/bb7…	x_refsource_MISC
https://github.com/angular/angular-cli/commit/c3e…	x_refsource_MISC
https://github.com/angular/angular-cli/releases/t…	x_refsource_MISC
https://github.com/angular/angular-cli/releases/t…	x_refsource_MISC
https://github.com/angular/angular-cli/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
angular	angular-cli	Affected: < 20.3.36 Affected: >= 21.0.0, < 21.2.23 Affected: >= 22.0.0, < 22.1.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T20:12:27.563771Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T20:12:49.364Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular-cli",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.36"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 21.2.23"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.1.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T19:43:50.475Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q"
        },
        {
          "name": "https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2"
        },
        {
          "name": "https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755"
        },
        {
          "name": "https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841"
        },
        {
          "name": "https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914"
        },
        {
          "name": "https://github.com/angular/angular-cli/releases/tag/v20.3.36",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular-cli/releases/tag/v20.3.36"
        },
        {
          "name": "https://github.com/angular/angular-cli/releases/tag/v21.2.23",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular-cli/releases/tag/v21.2.23"
        },
        {
          "name": "https://github.com/angular/angular-cli/releases/tag/v22.1.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular-cli/releases/tag/v22.1.7"
        }
      ],
      "source": {
        "advisory": "GHSA-7g7c-h8rr-7p6q",
        "discovery": "UNKNOWN"
      },
      "title": "Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104871",
    "datePublished": "2026-10-02T19:43:50.475Z",
    "dateReserved": "2026-10-02T14:59:11.775Z",
    "dateUpdated": "2026-10-02T20:12:49.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted