CVE-2026-92812
Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 16, 2026
- Updated
- Oct 28, 2026
- Reserved
- Sep 16, 2026
Description
Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
decap-cmsdecaporg |
|
References
- GitHub Security Advisory (GHSA-5rrq-v82w-qpfr)vendor-advisory
- Researcher Disclosureexploittechnical-description
- Fixed Release Tagrelease-notespatch
- VulnCheck Advisory: decap-server Path Traversal via Sibling Directory Prefix Matchingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.