{"id":"EUVD-2026-91778","enisaUuid":"4e062c50-5ebc-3c85-988e-f099dd919c16","description":"The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.","datePublished":"Oct 2, 2026, 7:43:50 PM","dateUpdated":"Oct 2, 2026, 8:12:49 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q\nhttps://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2\nhttps://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755\nhttps://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841\nhttps://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914\nhttps://github.com/angular/angular-cli/releases/tag/v20.3.36\nhttps://github.com/angular/angular-cli/releases/tag/v21.2.23\nhttps://github.com/angular/angular-cli/releases/tag/v22.1.7\n","aliases":"CVE-2026-104871\nGHSA-7g7c-h8rr-7p6q\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"265fa3ae-7064-3ce0-b354-d5c289c4dc1c","product":{"name":"angular-cli","vendor":{"name":"angular"}},"product_version":"22.0.0, \u003c 22.1.7"},{"id":"3eefc198-3c00-395a-80e9-3b98240ac566","product":{"name":"angular-cli","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.2.23"},{"id":"de161dad-5f88-3f51-a999-37522bc88228","product":{"name":"angular-cli","vendor":{"name":"angular"}},"product_version":"\u003c 20.3.36"}],"enisaIdVendor":[{"id":"7ecc9914-0397-316a-a0d5-cf6111d78cd6","vendor":{"name":"angular"}}],"enisaIdVulnerability":[{"id":"59731066-26c9-3e7d-bd45-79f33de19c2b","vulnerability":{"id":"GHSA-7g7c-h8rr-7p6q","description":"Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows","datePublished":"Oct 5, 2026, 10:53:45 PM","dateUpdated":"Oct 5, 2026, 10:53:45 PM","baseScore":0.0,"references":"https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104871\nhttps://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2\nhttps://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755\nhttps://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841\nhttps://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914\nhttps://github.com/angular/angular-cli\nhttps://github.com/angular/angular-cli/releases/tag/v20.3.36\nhttps://github.com/angular/angular-cli/releases/tag/v21.2.23\nhttps://github.com/angular/angular-cli/releases/tag/v22.1.7\n","enisa_id":"EUVD-2026-91778\n","aliases":"CVE-2026-104871\nGHSA-7g7c-h8rr-7p6q\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ba2bc91a-935a-3918-9d72-fcdc15dda7cf","vulnerability":{"id":"CVE-2026-104871","description":"The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.","datePublished":"Oct 2, 2026, 7:43:50 PM","dateUpdated":"Oct 2, 2026, 8:12:49 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q\nhttps://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2\nhttps://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755\nhttps://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841\nhttps://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914\nhttps://github.com/angular/angular-cli/releases/tag/v20.3.36\nhttps://github.com/angular/angular-cli/releases/tag/v21.2.23\nhttps://github.com/angular/angular-cli/releases/tag/v22.1.7\n","enisa_id":"EUVD-2026-91778\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Nov 11, 2026, 7:21:11 AM","vulnerabilityProduct":[{"id":"24fb59aa-1e84-3630-995d-7cc1ea47f696","product":{"name":"angular-cli","vendor":{"name":"angular"}},"product_version":"22.0.0, \u003c 22.1.7"},{"id":"b801b048-a570-3e0a-b342-5125fc70d0ad","product":{"name":"angular-cli","vendor":{"name":"angular"}},"product_version":"\u003c 20.3.36"},{"id":"faac95b4-4705-364f-b0ed-31b88c9057ae","product":{"name":"angular-cli","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.2.23"}],"vulnerabilityVendor":[{"id":"b39ed3fe-c12c-3d51-b50b-142bdb9dc3c1","vendor":{"name":"angular"}}]}}],"enisaIdAdvisory":[{"id":"20820b2f-02af-3b93-b46d-a097873ffb83","advisory":{"id":"WID-SEC-W-2026-3745","description":"Angular: Schwachstelle ermöglicht Offenlegung von Informationen","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Angular ausnutzen, um Informationen offenzulegen.","datePublished":"Oct 5, 2026, 10:00:00 PM","dateUpdated":"Oct 5, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3745.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3745\n","aliases":"CVE-2026-104871\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"bddea27b-00af-3a57-9608-e37f2f39c39b","product":{"name":"20.3.36","vendor":{"name":"open source"}}},{"id":"c50dfdd3-6c40-3d49-8c02-3c057d7512ba","product":{"name":"22.1.7","vendor":{"name":"open source"}}},{"id":"d491bc50-afea-30ae-a8c3-29b888d6b694","product":{"name":"21.2.23","vendor":{"name":"open source"}}},{"id":"f0b8e221-c8c9-3c92-a2c1-702741347b57","product":{"name":"angular","vendor":{"name":"angular"}}}]}}]}