CVE-2026-92812: decap-server Path Traversal via Sibling Directory Prefix Matching
Published Sep 16, 2026
·Updated
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
Event History
Sep 16, 2026
CVE Published
via MITRE·08:32 PM
Data Sourced
via MITRE·08:32 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
Exploitation requires network access and user interaction, according to the CVSS vector. The attacker targets paths in a sibling directory whose name starts with the repository directory name, bypassing the local proxy's string-prefix containment check.
2
What resources are exposed outside the repository root?
Files in matching sibling directories may be read, written, or deleted. The available data does not identify a narrower file-type or permission boundary.