{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/esm.sh/web--0.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:esm_sh:esm_sh_web:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-102657"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["esm.sh/web (\u003c 0.2.0)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","cve-2026-102657","arbitrary-file-read"],"_cs_type":"advisory","_cs_vendors":["esm.sh"],"content_html":"\u003cp\u003eThe \u003ccode\u003eweb.NewHandler\u003c/code\u003e component in \u003ccode\u003eesm.sh/web\u003c/code\u003e (versions \u0026lt; 0.2.0) contains a path traversal vulnerability. When a request path contains URL-encoded dot-segments (e.g., \u003ccode\u003e%2e%2e\u003c/code\u003e), Go's \u003ccode\u003eServeMux\u003c/code\u003e fails to redirect the request, and the handler proceeds to join the decoded path with \u003ccode\u003eAppDir\u003c/code\u003e without performing a containment check. This allows unauthenticated attackers to read files located outside the intended application directory, restricted only by the filesystem permissions of the server process.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts an HTTP GET request containing URL-encoded traversal segments (e.g., \u003ccode\u003e/%2e%2e/%2e%2e/secret.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe network-facing \u003ccode\u003ehttp.ServeMux\u003c/code\u003e decodes the request path.\u003c/li\u003e\n\u003cli\u003eBecause the segments are URL-encoded, \u003ccode\u003eServeMux\u003c/code\u003e does not block or redirect the request.\u003c/li\u003e\n\u003cli\u003eThe request is passed to \u003ccode\u003eweb.NewHandler\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eweb.NewHandler\u003c/code\u003e joins the \u003ccode\u003eConfig.AppDir\u003c/code\u003e path with the decoded \u003ccode\u003er.URL.Path\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application performs \u003ccode\u003eos.Lstat\u003c/code\u003e and \u003ccode\u003eos.Open\u003c/code\u003e on the resulting path, which resolves to a location outside the application directory.\u003c/li\u003e\n\u003cli\u003eThe server reads the file content and copies it into the HTTP response body, disclosing sensitive data to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to read arbitrary files on the filesystem accessible to the application process. This may include configuration files, environment variables, source code, or private keys, depending on the server configuration and file permissions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eesm.sh/web\u003c/code\u003e to version 0.2.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eFor environments where upgrading is delayed, apply input validation at the web server or proxy level to block request paths containing \u003ccode\u003e%2e\u003c/code\u003e or \u003ccode\u003e..\u003c/code\u003e segments.\u003c/li\u003e\n\u003cli\u003eEnsure the web application runs with the principle of least privilege, restricting the filesystem access of the process to the absolute minimum required by \u003ccode\u003eAppDir\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-10T04:16:54Z","date_published":"2026-11-10T04:16:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-esm-sh-path-traversal/","summary":"An unauthenticated path traversal vulnerability in esm.sh/web allows remote attackers to read arbitrary files by sending requests with URL-encoded dot-segments.","title":"esm.sh: web.NewHandler arbitrary file read via encoded dot-segment path traversal (CVE-2026-102657)","url":"https://feed.craftedsignal.io/briefs/2026-11-esm-sh-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Esm.sh/Web (\u003c 0.2.0)","version":"https://jsonfeed.org/version/1.1"}