critical9.8
CVE-2026-92812
Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path sepa…
Impact
Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
Affected products
| Product | Affected versions |
|---|---|
| Decap CMS | before 3.11.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/decaporg/decap-cms/releases?page=2#release-decap-cms@3.11.0
- https://github.com/decaporg/decap-cms/security/advisories/GHSA-5rrq-v82w-qpfr
- https://github.com/geo-chen/oss/blob/main/decap-cms.md
- https://www.vulncheck.com/advisories/decap-cms-path-traversal-via-sibling-directory-prefix-matching