{"vulnerability": "ghsa-fxqj-rqcc-2cmp", "sightings": [{"uuid": "dde1c0a4-e9e2-4381-8690-88f9137ecd48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-fxqj-rqcc-2cmp", "type": "seen", "source": "https://gist.github.com/alon710/cea21195fa5b2fd7a130b5ccd15ff053", "content": "# CVE-2026-69153: CVE-2026-69153: Arbitrary File Read via Path Traversal in PostCSS\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69153\n\n## Summary\nA directory traversal and arbitrary file read vulnerability exists in PostCSS due to an incomplete fix of CVE-2026-45623. When parsing a CSS file containing a sourceMappingURL comment with the 'from' parameter unset, path traversal and absolute path validations are bypassed, enabling attackers to read arbitrary local .map files.\n\n## TL;DR\nPostCSS fails to validate sourceMappingURL paths when the 'from' option is omitted, allowing unauthenticated attackers to read arbitrary local .map files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.3\n- **Impact**: Confidentiality (Partial File Disclosure)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications running server-side PostCSS compilation libraries without configuring the 'from' parameter.\n- **postcss**: < 8.5.19 (Fixed in: `8.5.19`)\n- **postcss**: >= 8.5.20 < 8.5.23 (Fixed in: `8.5.23`)\n\n## Mitigation\n\n- Upgrade PostCSS to version 8.5.19, 8.5.23 or newer.\n- Always set the 'from' option in options when running PostCSS on untrusted input.\n- WAF rules to filter or sanitize CSS files containing directory traversal indicators in sourceMappingURL.\n\n**Remediation Steps:**\n1. Run 'npm install postcss@latest' to update the dependency to the secure version.\n2. Inspect source code for usages of postcss().process() or postcss.parse().\n3. Verify that the 'from' option is configured with a valid path prefix on all input CSS parsing pipelines.\n\n## References\n\n- [NVD - CVE-2026-69153](https://nvd.nist.gov/vuln/detail/CVE-2026-69153)\n- [GitHub Security Advisory GHSA-fxqj-rqcc-2cmp](https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp)\n- [PostCSS 8.5.19 Release Notes](https://github.com/postcss/postcss/releases/tag/8.5.19)\n- [CVE.org - CVE-2026-69153](https://www.cve.org/CVERecord?id=CVE-2026-69153)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69153) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T18:31:17.160344Z"}]}