Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching
Impact
Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
Source excerpt · VulnCheckAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
decaporg · decap-cms
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 0 to before 3.11.0 | affected |
Original source description
Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
References
- Security advisory github.com/decaporg/decap-cms/security/advisories/GHSA-5rrq-v82w-qpfr
- Source reference github.com/geo-chen/oss/blob/main/decap-cms.md
- Source reference github.com/decaporg/decap-cms/releases
- Security advisory www.vulncheck.com/advisories/decap-cms-path-traversal-via-sibling-directory-prefix-matching