{"id":"CVE-2026-109823","aliases":[],"title":"Host filesystem path disclosure via DNS rebinding","description":"An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.\n\nNeither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout.\n\nThis issue affects tidewave: from 0.8.0 before 0.9.2.","severity":"low","score":2.3,"published":"2026-10-27T15:47:36.862Z","modified":"2026-10-27T15:47:36.862Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://cna.erlef.org/cves/CVE-2026-109823.html","https://osv.dev/vulnerability/EEF-CVE-2026-109823","https://github.com/tidewave-ai/tidewave_phoenix/commit/f78352b56d19cd4ae49999aa385011cef73e8b93","https://github.com/tidewave-ai/tidewave_phoenix/commit/80159536f752dc4d34797934d1516f29cea12b50"],"sources":[{"name":"CVE","id":"CVE-2026-109823","modified":"2026-10-27T15:47:36.862Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-109823"}],"assessments":[{"source":"CNA","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":2.3}]}