Medium, CVSS 5.1npmAmendedPublished
coursevault-preview has a path traversal due to improper base-directory boundary validation
CVE-2026-35613 · GHSA-9h9m-rr67-9jpg
- Affected
- npm coursevault-preview < 0.1.1
- Fixed in
- 0.1.1· Vendor fix available
- Issue
- coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. Details The vulnerable code in src/utils/errors.ts: Because the check is a raw string prefix test rather than a path-boundary test, the following bypass is possible: Any file whose absolute path begins with the baseDir string — including files in sibling directories that share a name prefix — passes the guard and can be accessed by the caller through affected file-access methods. The fix replaces the check with a separator-aware comparison: Impact An application that passes untrusted input as the relativePath argument to…
Recommended action: Upgrade to 0.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.