CVE-2026-104871: Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@angular/ssrto a version that resolves this vulnerability.Fixed in 20.3.36 - Upgrade
Upgrade
@angular/ssrto a version that resolves this vulnerability.Fixed in 21.2.23 - Upgrade
Upgrade
@angular/ssrto a version that resolves this vulnerability.Fixed in 22.1.7
Event History
Frequently Asked Questions
Which deployments are actually exposed?
Exposure is limited to Windows deployments using Angular SSR where relative request URLs are passed to CommonEngine.render. A qualifying sibling output directory must share the configured public-directory prefix and contain a prerendered Angular HTML page with the Angular SSG marker.
Does exploitation require authentication or user interaction?
No. An unauthenticated requester can exploit the issue by supplying a relative request URL containing a backslash parent-traversal segment; no user interaction is required.
What data can an attacker retrieve?
The issue can expose qualifying prerendered HTML pages from sibling output directories. It does not allow arbitrary file reads.
What versions contain the fix?
Upgrade to version 20.3.36, 21.2.23, or 22.1.7, as applicable. The affected @angular/ssr/node logic is present before those versions, and @angular/ssr is affected for versions 17 through 18.