{"id":"EUVD-2026-19790","enisaUuid":"a71237d9-a76a-3e47-8b1c-1ce73aa1e42a","description":"coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. This vulnerability is fixed in 0.1.1.","datePublished":"Apr 7, 2026, 4:39:44 PM","dateUpdated":"Apr 9, 2026, 4:18:16 PM","baseScore":5.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/moritzmyrz/coursevault-preview/security/advisories/GHSA-9h9m-rr67-9jpg\n","aliases":"CVE-2026-35613\nGHSA-9h9m-rr67-9jpg\n","assigner":"GitHub_M","epss":0.14,"enisaIdProduct":[{"id":"ca324efb-fe98-3ebf-94e8-36d7f4049f66","product":{"name":"coursevault-preview","vendor":{"name":"moritzmyrz"}},"product_version":"\u003c 0.1.1"}],"enisaIdVendor":[{"id":"1ba89658-b7ba-3f3b-80f1-6f2f23896f13","vendor":{"name":"moritzmyrz"}}],"enisaIdVulnerability":[{"id":"6d61f01c-c90c-3b33-be70-2ab4145e2361","vulnerability":{"id":"GHSA-9h9m-rr67-9jpg","description":"coursevault-preview has a path traversal due to improper base-directory boundary validation","datePublished":"Apr 8, 2026, 12:06:03 AM","dateUpdated":"Apr 8, 2026, 12:06:03 AM","baseScore":0.0,"references":"https://github.com/moritzmyrz/coursevault-preview/security/advisories/GHSA-9h9m-rr67-9jpg\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35613\nhttps://github.com/moritzmyrz/coursevault-preview\n","enisa_id":"EUVD-2026-19790\n","aliases":"GHSA-9h9m-rr67-9jpg\nCVE-2026-35613\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e82cf49b-4503-319a-a5e4-2f3c36ebd4cf","vulnerability":{"id":"CVE-2026-35613","description":"coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. This vulnerability is fixed in 0.1.1.","datePublished":"Apr 7, 2026, 4:39:44 PM","dateUpdated":"Apr 9, 2026, 4:18:16 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/moritzmyrz/coursevault-preview/security/advisories/GHSA-9h9m-rr67-9jpg\n","enisa_id":"EUVD-2026-19790\n","assigner":"GitHub_M","epss":0.14,"dataProcessed":"Oct 27, 2026, 7:18:59 AM","vulnerabilityProduct":[{"id":"38aca4bb-3dd4-3306-87b4-5c1a205e9191","product":{"name":"coursevault-preview","vendor":{"name":"moritzmyrz"}},"product_version":"\u003c 0.1.1"}],"vulnerabilityVendor":[{"id":"061c4c99-be76-3fc1-852f-224b15467673","vendor":{"name":"moritzmyrz"}}]}}],"enisaIdAdvisory":[]}