Quasar App Vite CVE-2026-106108

Exploitation requires running an SSG build ('quasar build -m ssg') with @quasar/app-vite 3.1.0-3.2.0 where getSsgPages() returns page definitions whose 'dir'/'filename' values are attacker-controllable - specifically when the application derives those SSG page definitions from external or otherwise untrusted content, or when the build configuration is compromised. A traversal payload (e.g. '../') or a pre-existing symlink beneath distDir is needed to redirect output outside build.distDir. Limiting factors: SSG page definitions and Quasar config are trusted input by default, so default deployments are not exploitable; the SSG renderer's no-overwrite behavior prevents overwriting existing files, restricting impact to creation of new files/directories; and the flaw is local/build-time only, not remotely reachable against a running service.

No CVSS vector, EPSS score, KEV status, or SSVC data was provided (CVSS Score and Vector are both N/A), so quantitative exploitation signals are absent and risk must be judged from the CWE-22 classification and the vendor description. This is a build-time path traversal in @quasar/app-vite's SSG builder, not a network-facing primitive: the vendor explicitly states that Quasar application configuration and SSG page definitions are trusted input by default, so under normal use this is low real-world risk. It becomes meaningful only when an application derives getSsgPages() definitions from external/untrusted content or when the build configuration itself is compromised - a non-default precondition that sharply narrows the realistic attack surface. No public exploit was identified and there is no CISA KEV listing, consistent with a low-urgency hardening fix rather than active exploitation. The SSG renderer's no-overwrite behavior further caps impact to creation of new files/directories (existing files cannot be clobbered). Net assessment: a legitimate but low-to-moderate priority issue - patch during normal maintenance unless your application feeds untrusted data into SSG page definitions, in which case prioritize it.

An application generates its SSG pages dynamically from an external source (e.g. a headless CMS or user-submitted content) and passes those values into getSsgPages(). An attacker supplies a page definition whose 'dir'/'filename' contains parent-directory traversal (or targets a path under an attacker-planted symlink); when a developer or CI runs 'quasar build -m ssg', the builder joins the values to build.distDir and writes a new HTML file outside the intended output tree with the build user's permissions. No public exploit code is known, though a vendor patch commit exists.