EUVD-2026-81070
GHSA-fjm6-6gxh-mvf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach decap-server /api/v1 JSON API
-
ExploitSend getMediaFile/persistMedia/deleteFile with ../ sibling-prefix payload
-
ExecutionPass raw startsWith() boundary check
-
ImpactRead, write, or delete files outside repository root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the official packages/decap-server running with the local_git backend and its CORS-enabled /api/v1 JSON API reachable by the attacker (no authentication is required per PR:N, and no user interaction per UI:N). A specific limiting factor applies: because the flawed guard uses path.join + startsWith(repoPath) string matching, the attacker can only reach a sibling directory whose name BEGINS WITH the configured repository directory's name (e.g., repo 'decaporg__decap-cms' allows reaching 'decaporg__decap-cms-owned') - it is not arbitrary filesystem traversal to any absolute path. The dominant real-world limiter is deployment exposure: decap-server is a local development proxy typically bound to localhost, so network exploitation depends on it being exposed beyond the developer's machine or driven through the victim's browser via the enabled CORS. |
| Impact | Signals conflict and must be weighed carefully. The CVSS 4.0 base score of 9.3 (AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H) reflects an unauthenticated, low-complexity flaw granting full read/write/delete impact, and the vuln.today Decision label is act_now. However, the EPSS score is low at 0.29% (22nd percentile), there is no CISA KEV listing (not confirmed actively exploited), and the referenced PoC is a reference only, not verified as working exploit code. The most important contextual caveat: decap-server is the local_git development proxy for Decap CMS, which by default serves a localhost-bound, CORS-enabled JSON API intended for a developer's own machine - so the AV:N rating is technically correct for the API surface but real-world network reachability depends on whether the proxy is exposed beyond localhost (or reachable via a browser/DNS-rebinding path given the enabled CORS). The low EPSS combined with act_now suggests the priority is driven by the clean unauthenticated technical impact rather than observed mass exploitation. Net: treat as a genuine priority to patch for anyone running decap-server reachable beyond localhost, but the raw 9.3 overstates risk for the typical localhost-only development deployment - verify exposure before escalating. |
| Exploit ScenarioDerived | An attacker able to send HTTP requests to a reachable decap-server /api/v1 endpoint running the local_git backend submits a getMediaFile, persistMedia, or deleteFile action with a path such as '../decaporg__decap-cms-owned/secret.txt'. Because the boundary check only does a raw string-prefix comparison, the request resolves into a sibling directory whose name begins with the repository directory name, letting the attacker read, overwrite, or delete files outside the repository root. A public PoC reference exists that automates all three operations; it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 22, 2026
Path traversal in decap-server 3.10.0 and earlier lets unauthenticated remote attackers read, write, and delete files in sibling directories that merely share the leading string of the configured local_git repository path. The flaw sits in the Joi input validator that guards the CORS-enabled /api/v1 JSON API: path.join plus a raw startsWith(repoPath) prefix check cannot distinguish a genuine child path from a sibling such as 'decaporg__decap-cms-owned' next to 'decaporg__decap-cms', so crafted '../<sibling>/file' payloads reach the getMediaFile, persistMedia and deleteFile handlers and achieve high-confidentiality, high-integrity and high-availability impact on files outside the repository root. Exploitation is constrained by deployment exposure (the package is a local development proxy usually bound to localhost) and by the prefix-collision requirement, which rules out arbitrary filesystem traversal to any absolute path; a public PoC reference exists but it is not verified as working exploit code, there is no confirmed actively exploited (CISA KEV) status, and EPSS is low at 0.29% (22nd percentile) even though the vuln.today priority label is act_now. Vendor-released patch: 3.11.0.
Earlier versions of this analysis (1)
Path traversal in decap-server's local proxy containment guard allows an unauthenticated attacker to read, write, or delete files outside the intended repository root whenever a sibling directory's name begins with the repository directory's name. Affected is the decap-server package shipped in the decaporg/decap-cms monorepo, confirmed at commit 11f35405cd1a1d1216e97b890173f46436752019, with the CPE wildcard suggesting all tracked versions of decap-server are in scope. Exploitation requires the local proxy backend to be running, victim interaction to drive requests to it, and the presence of a suitably named sibling directory containing the target files; publicly available exploit code exists, but there is no indication of confirmed active exploitation (no CISA KEV listing) at time of analysis, so this reads as a real but tightly scoped issue rather than a mass-exploitation priority.
RemediationAI
Upgrade to decap-server 3.11.0, the vendor-released patch version listed alongside this advisory (see https://github.com/decaporg/decap-cms/security/advisories/GHSA-5rrq-v82w-qpfr and the decap-cms@3.11.0 release notes); confirm the installed npm dependency resolves to 3.11.0 or later, since the wildcard CPE means any earlier build retains the prefix-comparison guard. If upgrading immediately is not possible, the highest-value control is reducing reachability of the /api/v1 JSON endpoint: bind decap-server to 127.0.0.1 only and place it behind a reverse proxy or firewall rule that restricts /api/v1 to trusted hosts, which removes the network attack path but breaks any legitimate remote or browser-driven use of the proxy (including the CORS workflow the package enables). Tightening or disabling the CORS configuration in packages/decap-server/src/middlewares/common/index.ts limits cross-origin driving of the proxy through a victim's browser, at the cost of breaking browser-based CMS clients that rely on cross-origin calls. Switching from the local_git backend to a hosted Git backend removes the filesystem-backed handlers entirely, at the cost of that backend's own credential and API requirements. Additionally, ensure no sibling directory of the configured repository root shares its leading directory name (for example 'repo' versus 'repo-owned'), since that prefix collision is the precondition for exploitation; this is a deployment-level containment measure only and does not fix the code. Where the code can be modified, apply the advisory's canonical boundary check using path.resolve with a repoRoot + path.sep prefix comparison, reject '..' segments, and re-validate at each read, write and delete call site in packages/decap-server/src/middlewares/localGit/index.ts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
decap-server is the Node.js/TypeScript backend that ships inside the decaporg/decap-cms monorepo (packages/decap-server) and serves as a local proxy for Decap CMS, exposing a JSON request surface at /api/v1 that is wired up with CORS in src/middlewares/common/index.ts. When the local_git backend is selected, requests such as getMediaFile, persistMedia and deleteFile are dispatched in src/middlewares/localGit/index.ts to concrete filesystem operations under a configured repository directory. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the repository-boundary guard in src/middlewares/joi/customValidators.ts computes const resolvedPath = path.join(repoPath, value) and then rejects only when !resolvedPath.startsWith(repoPath). path.join performs lexical normalisation, not canonicalisation, and a plain string prefix comparison has no notion of a path separator, so any sibling directory whose name begins with the repository directory's name (for example 'decaporg__decap-cms-owned' beside 'decaporg__decap-cms') satisfies the check while resolving outside the intended root. Validation in the supplied advisory confirms the same defect reaches all three primitives: reading secret.txt, creating write.txt and removing delete-me.txt in the prefix-colliding sibling. The recommended fix replaces the string comparison with a path.resolve-based boundary test that compares against repoRoot plus path.sep (or an exact equality with the root), and the advisory additionally recommends rejecting '..' segments outright and re-enforcing the boundary immediately before every filesystem call rather than trusting input validation alone. Note that the trigger is not a generic traversal primitive: only sibling paths sharing the repository directory's leading string are reachable.
Know when Decap Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated, no-interaction requests to a CORS-enabled HTTP API (AV:N/AC:L/PR:N/UI:N) yield out-of-repo read, write, and delete within the same server process authority (S:U, C/I/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
Articles & Coverage 1
Technical POC Analysis
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, path traversal).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
CVE-2026-92812 is a critical path traversal vulnerability in decap-server 3.10.0 and earlier that allows unauthenticated attackers to read, write, and delete files in sibling directories that share a prefix with the configured local_git repository path. This primarily affects development environments where the server is used, potentially exposing sensitive configuration or source files, but exploitation is constrained by localhost binding and prefix-collision requirements. Leadership should prioritize patching developer workstations and reviewing development infrastructure security.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to localhost only, implementing strong network segmentation to prevent remote exploitation, and monitoring file system activity for anomalous access to sibling directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB