{"id":"CVE-2026-48049","revision":null,"records":[{"revision":"85ab32126a55491b81afa8156a76adbb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-48049","aliases":[],"title":"@hapi/inert: Static-file confinement bypass via sibling-prefix path","description":"@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.","state":0,"publishedAt":"2026-07-17T21:03:16.577+00:00","modifiedAt":"2026-07-21T02:26:04.404+00:00","affected":[{"ecosystem":"Vendor product","name":"inert","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"hapijs\",\n                    \"product\": \"inert\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 4.0.0, < 7.1.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g","https://github.com/hapijs/inert/pull/176","https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9","https://github.com/hapijs/inert/releases/tag/v7.1.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-48049","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-48049","identifiers":["CVE-2026-48049"]},"retained":false,"historicalAffected":[]},{"revision":"364fd8dde4134347bb6b28a7242fe2ce","observedAt":"2026-10-25T12:17:26.301+00:00","statement":{"source":"nvd","id":"CVE-2026-48049","aliases":[],"title":"@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement e…","description":"@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.","state":0,"publishedAt":"2026-07-17T22:17:14.557+00:00","modifiedAt":"2026-10-24T20:10:00.137+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9","https://github.com/hapijs/inert/pull/176","https://github.com/hapijs/inert/releases/tag/v7.1.1","https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48049","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22"],"productCriteria":[],"sourceDates":{"published":"2026-07-17T22:17:14.557","lastModified":"2026-10-24T20:10:00.137"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-48049","identifiers":["CVE-2026-48049"]},"retained":false,"historicalAffected":[]},{"revision":"3fcc9ef8e56c499490d7af673bd9fe3c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-rcvq-m9j9-6f4g","aliases":["CVE-2026-48049"],"title":"@hapi/inert has a static-file confinement bypass via sibling-prefix path","description":"### Impact\n`@hapi/inert` serves static files from a directory configured with `path` (in the `directory` / `file` handlers) or `relativeTo` (for `h.file()`), with confinement enforced by the `confine` option (default `true`). Before the patch, the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory whose absolute path begins with the same characters as the confine directory (eg. `/app/static-secret` next to a served `/app/static`) was incorrectly accepted as confined. An unauthenticated remote attacker who knows or guesses such a sibling name can read any file inside it via a request like `/..%2fstatic-secret/secret.txt`, provided the file is readable by the server process. Only applications that happen to have a sibling directory sharing a string prefix with the served directory are exploitable; applications with no such sibling are unaffected.\n\n### Patches\nUpgrade to 7.1.1.\n\n### Workarounds\nFor users who cannot upgrade immediately: ensure the directory served via inert has no sibling whose name starts with the same characters (for example, rename `static-secret/` to `secret/`, or move it to a different parent directory).\n\n### Resources\nPull Request: https://github.com/hapijs/inert/pull/176","state":0,"publishedAt":"2026-06-11T17:10:15+00:00","modifiedAt":"2026-09-10T03:50:50.4450116+00:00","affected":[{"ecosystem":"npm","name":"@hapi/inert","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"7.1.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g","https://github.com/hapijs/inert/pull/176","https://github.com/hapijs/inert/commit/a65e5b271b5c3405af463469959c5e052eb23a62","https://github.com/hapijs/inert"],"sourceUrl":"https://github.com/advisories/GHSA-rcvq-m9j9-6f4g","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rcvq-m9j9-6f4g","identifiers":["GHSA-rcvq-m9j9-6f4g","CVE-2026-48049"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T04:23:20.6482565+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T04:23:20.6482565+00:00","lastSuccessAt":"2026-10-27T04:23:21.0403366+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:21.0403386+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-44adb5fc4ec2447b4a14a9a186d21f635f5ab0fe59c9ca03fbd7387196ed1b95","complete":true,"records":414861,"lastAttemptAt":"2026-10-27T04:23:19.4839227+00:00","lastSuccessAt":"2026-10-27T04:23:19.4592214+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:19.4839227+00:00","snapshotPublishedAt":"2026-10-27T03:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T04:24:29.5120624+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T04:23:20.6482565+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T04:23:20.6482565+00:00","lastSuccessAt":"2026-10-27T04:23:21.0415276+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:21.0415281+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1e75823a9a3a4b74973abff44e356610","complete":false,"records":13416,"lastAttemptAt":"2026-10-27T04:24:27.4557647+00:00","lastSuccessAt":"2026-10-27T04:24:27.452+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:24:27.452+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13077,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T04:23:20.1429206+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.1429206+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T04:23:19.6550338+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:19.6550338+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-27T04:23:20.5252815+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.5252815+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-2c2579bb03487537529e2b647fd2d9950cfc0fec1a9832dba33e322b8dcbe369","complete":true,"records":230812,"lastAttemptAt":"2026-10-27T04:23:20.0379863+00:00","lastSuccessAt":"2026-10-26T21:37:26.5810298+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.0379863+00:00","snapshotPublishedAt":"2026-10-26T21:33:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}