Skip to content
Heist/ feed
MediumFix available

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

Type: advisorySource: OSV1 source record

A Path Traversal vulnerability exists in the prerendered (SSG) page retrieval logic of `CommonEngine` in `@angular/ssr/node` (and `@angular/ssr` in earlier versions). When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes `CommonEngine` to serve prerendered pages from sibling output directories. The vulnerability occurs due to how relative URLs and Windows file paths are resolved and validated: 1. A request URL containing a backslash parent traversal segment (e.g., `/..\app-admin`) is passed to `CommonEngine.render({ url })`. 2. The engine parses the URL using `new URL(url, 'resolve://')`. Because `resolve://` is a non-special scheme under the WHATWG URL standard, backslashes are not normalized to forward slashes, leaving the `pathname` unnormalized as `/..\app-admin`. 3. The engine constructs the candidate file path using `join(publicPath, pathname, 'index.html')`. On Windows, `path.join` treats `\` as a path delimiter, resolving the parent segment (`..\`) out of `publicPath` (e.g., `dist\app`) into a sibling directory (e.g., `dist\app-admin\index.html`). 4. The containment check (`pagePath.startsWith(normalize(publicPath))`) performs a prefix match without a trailing path delimiter. Because the sibling folder name starts with the configured public folder name (e.g., `dist\app-admin` starts with `dist\app`), the check erroneously succeeds. 5. If the target file exists and contains the Angular SSG marker (`ng-se

Announced Source revision 1
Original source ↗

GHSA-7g7c-h8rr-7p6q

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-7g7c-h8rr-7p6q

@angular/ssr

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
22.1.7

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

@angular/ssr

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
21.2.23

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

@angular/ssr

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
20.3.36

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

@angular/ssr

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "22.0.0"
          },
          {
            "fixed": "22.1.7"
          }
        ]
      }
    ],
    "package": {
      "name": "@angular/ssr",
      "purl": "pkg:npm/%40angular/ssr",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7g7c-h8rr-7p6q/GHSA-7g7c-h8rr-7p6q.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "21.0.0"
          },
          {
            "fixed": "21.2.23"
          }
        ]
      }
    ],
    "package": {
      "name": "@angular/ssr",
      "purl": "pkg:npm/%40angular/ssr",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7g7c-h8rr-7p6q/GHSA-7g7c-h8rr-7p6q.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "20.0.0"
          },
          {
            "fixed": "20.3.36"
          }
        ]
      }
    ],
    "package": {
      "name": "@angular/ssr",
      "purl": "pkg:npm/%40angular/ssr",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7g7c-h8rr-7p6q/GHSA-7g7c-h8rr-7p6q.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "19.2.27"
          }
        ]
      }
    ],
    "package": {
      "name": "@angular/ssr",
      "purl": "pkg:npm/%40angular/ssr",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7g7c-h8rr-7p6q/GHSA-7g7c-h8rr-7p6q.json"
    }
  }
]
Related CVEs
CVE-2026-104871

Source reference: /aliases

Publisher severity

medium

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-104871 · Medium

angular-cli

Event
#85837 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement