by Kastro
Paper/Archive/CVE-2026-92812

CVE-2026-92812

decaporg decap-cms — Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 38.3.383 × 207.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.

Affected

ProductAffectedFixed inSource
decap-cms< 3.11.03.11.0CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

advisorygithub.com/decaporg/decap-cms/security/advisories/GHSA-5rrq-v82w-qpfrexploitgithub.com/geo-chen/oss/blob/main/decap-cms.mdpatchgithub.com/decaporg/decap-cms/releases?page=2#[email protected]writeupvulncheck.com/advisories/decap-cms-path-traversal-via-sibling-directory-prefix-matching