CVE-2026-7120
mediumPriorität · verfolgen · 0EPSS 0.004 · 31. PerzentilEUUSEPSS · bewertet 2026-10-27
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-8pvw-jcv7-9cmj@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths2026-07-24ghsa · osvUS
### Impact `@fastify/static` evaluates the `allowedPath` callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as `//file`, `/./file`, or `/public/../private/file` bypass `allowedPath` filtering while resolving to the intended file on disk. Applications that use `allowedPath` as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied. ### Patches Upgrade to `@fastify/static` >= 10.1.2. ### Workarounds None. Upgrade to the patched version.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- https://cna.openjsf.org/security-advisories.htmlcnnvd
- https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmjcnnvd
- https://cna.openjsf.org/security-advisories.htmlenisa_euvd
- https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmjenisa_euvd
- https://cna.openjsf.org/security-advisories.htmlVendor Advisorynvd
- https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmjVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan