{"id":"CVE-2026-48049","sourceIdentifier":"security-advisories@github.com","published":"2026-07-17T22:17:14.557","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1."},{"lang":"es","value":"@hapi/inert proporciona manejadores de archivos estáticos y directorios para hapi.js. Desde la versión 4.0.0 hasta la 7.1.0, @hapi/inert sirve archivos estáticos desde un directorio configurado con ’path’ en los manejadores de directorio o archivo, o con ’relativeTo’ para h.file(), con el confinamiento aplicado por la opción ’confine’, pero la verificación de confinamiento comparó la ruta absoluta resuelta con el directorio de confinamiento utilizando una prueba de prefijo de cadena en bruto, por lo que un directorio hermano como /app/static-secret junto a /app/static fue aceptado incorrectamente y podría permitir a un atacante remoto no autenticado leer archivos a través de /..%2fstatic-secret/secret.txt. Este problema está solucionado en la versión 7.1.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"hapijs","product":"inert","versions":[{"version":">= 4.0.0, < 7.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-21T02:25:52.865059Z","id":"CVE-2026-48049","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/inert/pull/176","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/inert/releases/tag/v7.1.1","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g","source":"security-advisories@github.com"}]}