EUVD-2026-64850
GHSA-g84c-rxfj-3j2c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify dev server with non-slash-terminated publicPath (e.g., /assets)
-
DeliveryConfirm physical filesystem in use (writeToDisk: true)
-
ExploitCraft GET /assets../<target-file> HTTP request
-
InstallUP_PATH_REGEXP guard passes ('assets..' is not a whole-segment dot-dot)
-
C2Fixed-offset slice produces ../<target-file> path component
-
Executepath.join resolves component above outputPath
-
ImpactPhysical filesystem returns sensitive file contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two simultaneous non-default configuration conditions: (1) publicPath must be configured WITHOUT a trailing slash - for example '/assets' rather than '/assets/' or the default 'auto' (which resolves to '/' and is explicitly not affected); (2) the middleware must use the physical filesystem, which occurs only when devMiddleware.writeToDisk is set to true, or when a custom outputFileSystem backed by real disk storage is supplied - the default in-memory memfs volume is not vulnerable. Traversal depth is bounded to exactly one directory above outputPath because URL normalization collapses chained '..' sequences before the guard evaluates the pathname, preventing deeper traversal into the filesystem. The attack surface is development environments only, since webpack-dev-middleware is not a production web server. Direct unauthenticated exploitation without victim interaction is possible if the dev server is bound to 0.0.0.0 or any non-loopback address; if bound to 127.0.0.1 exclusively, exploitation requires local network presence or prior compromise of the developer's machine. |
| Impact | The CVSS 4.0 score of 8.3 with VC:H and SC:H accurately reflects the confidentiality severity of file disclosure but overstates exploitability for typical deployments, because two non-default conditions must be simultaneously present: a publicPath configured without a trailing slash and physical filesystem access via writeToDisk or custom outputFileSystem. The default publicPath of 'auto' (resolving to '/') is explicitly unaffected, and writeToDisk: true is an uncommon setting in standard development workflows. Traversal is hard-capped at exactly one directory above outputPath, because multi-segment dot-dot sequences are collapsed by URL normalization before the guard runs - this sharply limits blast radius compared to unrestricted path traversal. No CISA KEV listing is present and no EPSS data was supplied, so no signal of active exploitation exists at time of analysis. The GHSA-wr3j-pwj9-hqq6 advisory for CVE-2024-29180 contained a working PoC for the same attack class, indicating the attack technique is publicly understood. The mismatch between whole-segment guard matching and offset-based slicing is a subtle logic flaw; teams operating non-default configurations - particularly those binding dev servers to non-loopback addresses - should treat remediation as a near-term priority given that exploitation complexity once conditions are met is low. |
| Exploit ScenarioDerived | An attacker with network access to a development server where publicPath is '/assets' (no trailing slash) and writeToDisk is true sends the crafted request GET /assets../.env HTTP/1.1. The UP_PATH_REGEXP guard passes because 'assets..' is not a standalone '..' path segment; the fixed-offset slice produces '../.env'; and path.join resolves this to one level above outputPath, returning the contents of the .env file containing environment secrets. No authentication to webpack-dev-server is required once network access is established, and exploitation requires a single HTTP request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Path traversal in webpack-dev-middleware bypasses the incomplete CVE-2024-29180 fix by embedding dot-dot sequences within path segments (e.g., 'assets..') rather than as standalone segments, causing the UP_PATH_REGEXP guard to pass while the subsequent fixed-offset slice produces a parent-directory component that resolves above outputPath on the physical filesystem. Affected versions are precisely 5.3.4+, 6.1.2+, and 7.1.0+ - the releases that introduced the original guard-and-slice logic intended to fix path traversal. Exploitation is constrained to non-default configurations where publicPath lacks a trailing slash and the physical filesystem is in use via writeToDisk: true or a custom outputFileSystem; no public exploit identified at time of analysis, though a functional PoC for the predecessor attack class exists in GHSA-wr3j-pwj9-hqq6.
RemediationAI
Upgrade webpack-dev-middleware to v8.1.1 or later, where the path construction logic is corrected per patch commits https://github.com/webpack/webpack-dev-middleware/commit/189c4ac7d2344ec132a4689e74dc837ec5be0132 and https://github.com/webpack/webpack-dev-middleware/commit/9670b3495da518fe667ff3428c5e4cb9f2f3d353; note that no formal vendor-published advisory with an explicit fixed-version table has been independently verified beyond the v8.1.1 source reference. If immediate upgrade is not feasible, ensure publicPath always ends with a trailing slash (e.g., '/assets/' rather than '/assets') - this eliminates the offset-slice bypass vector, though it alters URL routing and requires application regression testing. Alternatively, remove writeToDisk: true and avoid supplying a custom physical outputFileSystem; reverting to the default memfs volume makes real-filesystem traversal impossible regardless of URL manipulation, with no change to build output behavior. Regardless of patch status, restrict webpack-dev-server to 127.0.0.1 only - never bind to 0.0.0.0 or a public interface - which prevents lateral network exploitation entirely and should be treated as a baseline security practice for all development servers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
webpack-dev-middleware (CPE: cpe:2.3:a:webpack:webpack-dev-middleware:*:*:*:*:*:*:*:*) is an Express/Connect middleware serving webpack build output over HTTP during development. The vulnerability resides in the getFilenameFromUrl function, which strips the publicPath prefix from incoming URLs via a fixed character-offset slice - pathname.slice(publicPathPathname.length) - after applying the UP_PATH_REGEXP traversal guard. The guard, applied to path.normalize('./{pathname}'), only flags '..' standing as a whole path segment. When publicPath is '/assets' (no trailing slash), a request pathname of '/assets../.env' passes the guard because 'assets..' is not a standalone '..' token. The slice then cuts at len('/assets') = 7 characters, yielding '../.env', which path.join(outputPath, '../.env') resolves one directory above outputPath on the real filesystem. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) caused by misalignment between the containment check (startsWith comparison) and the actual path construction (character-offset slice). Real-filesystem exposure occurs only when writeToDisk: true or a custom outputFileSystem is configured; the default memfs in-memory volume holds only build artifacts and is not exploitable.
Know when Webpack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
AC:H reflects the two required non-default conditions (no-trailing-slash publicPath and physical filesystem); PR:N because no authentication is required to the HTTP endpoint; C:H for sensitive file disclosure; I:N and A:N as exploitation is read-only.
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(./${pathname}), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward.
Blast Radius
ecosystem impact- 4 npm packages depend on webpack-dev-middleware (3 direct, 1 indirect)
Ecosystem-wide dependent count for version 7.0.0.
Executive ViewAI
A path traversal vulnerability in webpack-dev-middleware versions 5.3.4 and later could allow attackers to access files outside the intended application directory if the development server is exposed to untrusted networks and uses non-default disk-writing configurations. Development and DevOps teams using affected versions with writeToDisk enabled face potential exposure of source code, configuration files, and embedded secrets in development environments. Organizations should urgently audit their development infrastructure and either disable the vulnerable configuration or restrict network access to the development server.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable writeToDisk if persistent disk access is not required for your workflow; ensure all publicPath configurations include a trailing slash; use the default built-in outputFileSystem rather than custom file system implementations; restrict development server network access to localhost or trusted internal networks via firewall and network segmentation; and implement file system access auditing on development machines to detect and alert on suspicious path traversal patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Webpack is a module bundler. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentica
Webpack 5 before 5.76.0 does not avoid cross-realm object access. Rated critical severity (CVSS 9.8), this vulnerability
Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTT
Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTT
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Manager Client Tools 15 | Affected |
| SUSE Manager Client Tools for SLE 15 | Affected |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Affected |
| openSUSE Leap 16.0 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Manager Proxy Module 4.3 | Affected |
| SUSE Enterprise Storage 6 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| SUSE Manager Proxy LTS 4.3 | Affected |
| SUSE Manager Proxy Module 4.1 | Affected |
| SUSE Manager Proxy Module 4.2 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
| SUSE Multi Linux Manager Tools SLE-15 | Affected |
| ses/7.1/ceph/prometheus-server ses/7/ceph/prometheus-server suse/multi-linux-manager/5.2/x86_64/monitoring-prometheus | Affected |
Exploit-DB