https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 12:38:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290279 EUVD-2026-290279 https://cve.radiocsirt.org/vuln/euvd-2026-290279 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35613 <p>coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. This vulnerability is fixed in 0.1.1.</p> <p>coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. This vulnerability is fixed in 0.1.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35613 https://cve.radiocsirt.org/vuln/ghsa-9h9m-rr67-9jpg <p><strong>Affected:</strong> npm: coursevault-preview</p> <p>## Summary</p> <p>`coursevault-preview` versions prior to `0.1.1` contain a path traversal vulnerability in the `resolveSafe` utility. The boundary check used `String.prototype.startsWith(baseDir)` on a normalized path, which does not enforce a directory boundary. An attacker who controls the `relativePath` argument to affected `CoursevaultPreview` methods may be able to read files outside the configured `baseDir` when a sibling directory exists whose name shares the same string prefix.</p> <p>## Details</p> <p>The vulnerable code in `src/utils/errors.ts`:</p> <p>```ts if (!full.startsWith(base)) { // ← insufficient throw new Error(&#34;Path escapes the base directory&#34;); } ```</p> <p>Because the check is a raw string prefix test rather than a path-boundary test, the following bypass is possible:</p> <p>``` baseDir = &#34;/srv/courses&#34; payload = &#34;../courses-admin/config.json&#34; resolved = &#34;/srv/courses-admin/config.json&#34;</p> <p>&#34;/srv/courses-admin/config.json&#34;.startsWith(&#34;/srv/courses&#34;) // → true ✗ ```</p> <p>Any file whose absolute path begins with the `baseDir` string — including files in sibling directories that share a name prefix — passes the guard and can be accessed by the caller through affected file-access methods.</p> <p>The fix replaces the check with a separator-aware comparison:</p> <p>```ts if (full !== base &amp;&amp; !full.startsWith(base + sep)) { throw new Error(&#34;Path escapes the base directory&#34;); } ```</p> <p>## Impact</p> <p>An application that passes untrusted input as the `relativePath` argument to affected file-access methods may exp…</p> <p><strong>Affected:</strong> npm: coursevault-preview</p> <p>## Summary</p> <p>`coursevault-preview` versions prior to `0.1.1` contain a path traversal vulnerability in the `resolveSafe` utility. The boundary check used `String.prototype.startsWith(baseDir)` on a normalized path, which does not enforce a directory boundary. An attacker who controls the `relativePath` argument to affected `CoursevaultPreview` methods may be able to read files outside the configured `baseDir` when a sibling directory exists whose name shares the same string prefix.</p> <p>## Details</p> <p>The vulnerable code in `src/utils/errors.ts`:</p> <p>```ts if (!full.startsWith(base)) { // ← insufficient throw new Error(&#34;Path escapes the base directory&#34;); } ```</p> <p>Because the check is a raw string prefix test rather than a path-boundary test, the following bypass is possible:</p> <p>``` baseDir = &#34;/srv/courses&#34; payload = &#34;../courses-admin/config.json&#34; resolved = &#34;/srv/courses-admin/config.json&#34;</p> <p>&#34;/srv/courses-admin/config.json&#34;.startsWith(&#34;/srv/courses&#34;) // → true ✗ ```</p> <p>Any file whose absolute path begins with the `baseDir` string — including files in sibling directories that share a name prefix — passes the guard and can be accessed by the caller through affected file-access methods.</p> <p>The fix replaces the check with a separator-aware comparison:</p> <p>```ts if (full !== base &amp;&amp; !full.startsWith(base + sep)) { throw new Error(&#34;Path escapes the base directory&#34;); } ```</p> <p>## Impact</p> <p>An application that passes untrusted input as the `relativePath` argument to affected file-access methods may exp…</p> https://cve.radiocsirt.org/vuln/ghsa-9h9m-rr67-9jpg