Angular SSR EUVD-2026-91778

Exploitation is strictly limited to Windows deployments of @angular/ssr/node (or @angular/ssr for v17-18) that (1) use CommonEngine server-side rendering and pass RELATIVE request URLs to CommonEngine.render, (2) have a sibling output directory on disk whose name shares the configured public-directory prefix, and (3) contain a qualifying prerendered Angular HTML page bearing the Angular SSG marker in that sibling directory. The backslash-as-separator behavior only manifests on Windows path handling, so Linux/macOS hosts are not affected. No authentication or user interaction is required (PR:N/UI:N), but these stacked configuration and platform prerequisites (reflected as AT:P in the CVSS 4.0 vector) substantially limit real-world exploitability; the flaw does NOT permit arbitrary file read, only disclosure of an adjacent prerendered SSG HTML page.

This is a genuinely low-to-moderate risk issue despite the CVSS 4.0 base score of 6.3. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates a network-reachable, unauthenticated flaw, but the AT:P (Attack Requirements: Present) metric and the vulnerable-system impact of VC:L/VI:N/VA:N are the key signals: exploitation depends on several non-attacker-controlled preconditions and yields only limited confidentiality disclosure (one sibling prerendered HTML page), with no integrity or availability impact and explicitly NO arbitrary file read. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit code identified - only the upstream fix commits are available, which are patch artifacts, not weaponized exploits. The combination of narrow impact, Windows-only applicability, and the requirement for a prefix-sharing sibling output directory containing qualifying Angular SSG-marked HTML makes this a lower real-world priority than the 6.3 score suggests in isolation. It should be patched during normal cycles by affected Windows SSR operators rather than treated as an emergency.

An organization runs an Angular application with @angular/ssr CommonEngine server-side rendering on a Windows host, passing relative request URLs to CommonEngine.render, and has a sibling output directory whose name shares the configured public-directory prefix. A remote unauthenticated user sends a request whose relative URL contains a backslash parent-traversal segment, causing the retrieveSSGPage logic to resolve into the sibling directory and return a prerendered HTML page that was not intended to be served from the public path. No public exploit code was identified at time of analysis; only vendor fix commits exist.