Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by decaporg
CVE-2026-92812 (GCVE-0-2026-92812)
Vulnerability from nvd – Published: 2026-09-16 20:32 – Updated: 2026-09-16 20:32
VLAI
EPSS
VEX
Title
decap-server Path Traversal via Sibling Directory Prefix Matching
Summary
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/decap-cms.md | technical-descriptionexploit |
| https://github.com/decaporg/decap-cms/blob/11f354… | technical-description |
| https://github.com/decaporg/decap-cms | product |
| https://www.vulncheck.com/advisories/decap-server… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| decaporg | decap-server |
Affected:
11f35405cd1a1d1216e97b890173f46436752019
(git)
|
Date Public
2026-09-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "decap-server",
"vendor": "decaporg",
"versions": [
{
"status": "affected",
"version": "11f35405cd1a1d1216e97b890173f46436752019",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:58.261Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/decap-cms.md"
},
{
"name": "startsWith is used with no trailing separator",
"tags": [
"technical-description"
],
"url": "https://github.com/decaporg/decap-cms/blob/11f35405cd1a1d1216e97b890173f46436752019/packages/decap-server/src/middlewares/joi/customValidators.ts#L11-L16"
},
{
"tags": [
"product"
],
"url": "https://github.com/decaporg/decap-cms"
},
{
"name": "VulnCheck Advisory: decap-server Path Traversal via Sibling Directory Prefix Matching",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/decap-server-path-traversal-via-sibling-directory-prefix-matching"
}
],
"title": "decap-server Path Traversal via Sibling Directory Prefix Matching",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92812",
"datePublished": "2026-09-16T20:32:58.261Z",
"dateReserved": "2026-09-16T19:55:01.700Z",
"dateUpdated": "2026-09-16T20:32:58.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92812 (GCVE-0-2026-92812)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-16 20:32
VLAI
EPSS
VEX
Title
decap-server Path Traversal via Sibling Directory Prefix Matching
Summary
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/decap-cms.md | technical-descriptionexploit |
| https://github.com/decaporg/decap-cms/blob/11f354… | technical-description |
| https://github.com/decaporg/decap-cms | product |
| https://www.vulncheck.com/advisories/decap-server… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| decaporg | decap-server |
Affected:
11f35405cd1a1d1216e97b890173f46436752019
(git)
|
Date Public
2026-09-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "decap-server",
"vendor": "decaporg",
"versions": [
{
"status": "affected",
"version": "11f35405cd1a1d1216e97b890173f46436752019",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:58.261Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/decap-cms.md"
},
{
"name": "startsWith is used with no trailing separator",
"tags": [
"technical-description"
],
"url": "https://github.com/decaporg/decap-cms/blob/11f35405cd1a1d1216e97b890173f46436752019/packages/decap-server/src/middlewares/joi/customValidators.ts#L11-L16"
},
{
"tags": [
"product"
],
"url": "https://github.com/decaporg/decap-cms"
},
{
"name": "VulnCheck Advisory: decap-server Path Traversal via Sibling Directory Prefix Matching",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/decap-server-path-traversal-via-sibling-directory-prefix-matching"
}
],
"title": "decap-server Path Traversal via Sibling Directory Prefix Matching",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92812",
"datePublished": "2026-09-16T20:32:58.261Z",
"dateReserved": "2026-09-16T19:55:01.700Z",
"dateUpdated": "2026-09-16T20:32:58.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}