Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching
Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
CVE-2026-92812
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-92812
decap-cms
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/decaporg/decap-cms",
"vendor": "decaporg",
"product": "decap-cms",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "3.11.0",
"versionType": "semver"
}
],
"packageURL": "pkg:github/decaporg/decap-cms",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-92812
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #50382 · Revision 1
- Added to Heist Feed
- Publisher date