Decap Server
Monthly
Path traversal in decap-server's local proxy containment guard allows an unauthenticated attacker to read, write, or delete files outside the intended repository root whenever a sibling directory's name begins with the repository directory's name. Affected is the decap-server package shipped in the decaporg/decap-cms monorepo, confirmed at commit 11f35405cd1a1d1216e97b890173f46436752019, with the CPE wildcard suggesting all tracked versions of decap-server are in scope. Exploitation requires the local proxy backend to be running, victim interaction to drive requests to it, and the presence of a suitably named sibling directory containing the target files; publicly available exploit code exists, but there is no indication of confirmed active exploitation (no CISA KEV listing) at time of analysis, so this reads as a real but tightly scoped issue rather than a mass-exploitation priority.
Path traversal in decap-server's local proxy containment guard allows an unauthenticated attacker to read, write, or delete files outside the intended repository root whenever a sibling directory's name begins with the repository directory's name. Affected is the decap-server package shipped in the decaporg/decap-cms monorepo, confirmed at commit 11f35405cd1a1d1216e97b890173f46436752019, with the CPE wildcard suggesting all tracked versions of decap-server are in scope. Exploitation requires the local proxy backend to be running, victim interaction to drive requests to it, and the presence of a suitably named sibling directory containing the target files; publicly available exploit code exists, but there is no indication of confirmed active exploitation (no CISA KEV listing) at time of analysis, so this reads as a real but tightly scoped issue rather than a mass-exploitation priority.