GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-63225

Vulnerability from fkie_nvd - Published: 2026-09-16 19:17 - Updated: 2026-09-17 17:16
Severity
4.4 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Summary
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.
References
security-advisories@github.comhttps://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee
security-advisories@github.comhttps://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3
security-advisories@github.comhttps://github.com/Redocly/redocly-cli/pull/2891
security-advisories@github.comhttps://github.com/Redocly/redocly-cli/pull/2923
security-advisories@github.comhttps://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17
security-advisories@github.comhttps://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2
security-advisories@github.comhttps://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "redocly-cli",
          "vendor": "Redocly",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.34.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.33.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2."
    }
  ],
  "id": "CVE-2026-63225",
  "lastModified": "2026-09-17T17:16:45.010",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63225",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-17T16:13:39.074016Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-16T19:17:24.163",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Redocly/redocly-cli/pull/2891"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Redocly/redocly-cli/pull/2923"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.