Angular Cli
Monthly
Angular SSR's CommonEngine (in @angular/ssr/node, and in @angular/ssr for versions 17 through 18) can disclose a sibling prerendered HTML page on Windows when a relative request URL containing a backslash parent-traversal segment is passed to CommonEngine.render, affecting versions prior to 20.3.36, 21.2.23, and 22.1.7. Exploitation is unauthenticated and requires no user interaction (PR:N/UI:N) but is restricted to Windows deployments that pass relative request URLs, have a sibling output directory whose name shares the configured public-directory prefix, and hold a qualifying prerendered Angular page bearing the SSG marker; no public exploit code and no confirmed active exploitation were identified at time of analysis. Independent assessment rates the real-world risk low-to-moderate despite the 6.3 CVSS 4.0 base score, because these stacked platform and directory-layout prerequisites (captured as AT:P) sharply narrow exposure, and the flaw does not permit arbitrary file read - only disclosure of the adjacent prerendered SSG HTML page.
Angular SSR's CommonEngine (in @angular/ssr/node, and in @angular/ssr for versions 17 through 18) can disclose a sibling prerendered HTML page on Windows when a relative request URL containing a backslash parent-traversal segment is passed to CommonEngine.render, affecting versions prior to 20.3.36, 21.2.23, and 22.1.7. Exploitation is unauthenticated and requires no user interaction (PR:N/UI:N) but is restricted to Windows deployments that pass relative request URLs, have a sibling output directory whose name shares the configured public-directory prefix, and hold a qualifying prerendered Angular page bearing the SSG marker; no public exploit code and no confirmed active exploitation were identified at time of analysis. Independent assessment rates the real-world risk low-to-moderate despite the 6.3 CVSS 4.0 base score, because these stacked platform and directory-layout prerequisites (captured as AT:P) sharply narrow exposure, and the flaw does not permit arbitrary file read - only disclosure of the adjacent prerendered SSG HTML page.