CLSA-2026-1790972556

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1790972556.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1790972556
Upstream
Published
2026-10-02T20:22:48Z
Modified
2026-10-26T09:30:52Z
Summary
osbuild-composer: Fix of CVE-2026-55677
Details
  • CVE-2026-55677: stop unescaping the static file wildcard by default in Static, StaticFS, Group.StaticFS and StaticWithConfig of the vendored github.com/labstack/echo/v4 (the echo v4.15.4 fix), so an encoded separator (%2F, %5C) or dot-segment (%2E%2E) cannot resolve a static file outside the route the router matched and bypass route-level middleware; unescaping is opt-in via EnablePathUnescapingStaticFiles and StaticConfig.EnablePathUnescaping
References

Affected packages

TuxCare:AlmaLinux:9.2
osbuild-composer

Package

Name
osbuild-composer
Purl
pkg:rpm/tuxcare/osbuild-composer?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
76-2.el9_2.2.alma.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1790972556.json"
osbuild-composer-core

Package

Name
osbuild-composer-core
Purl
pkg:rpm/tuxcare/osbuild-composer-core?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
76-2.el9_2.2.alma.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1790972556.json"
osbuild-composer-dnf-json

Package

Name
osbuild-composer-dnf-json
Purl
pkg:rpm/tuxcare/osbuild-composer-dnf-json?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
76-2.el9_2.2.alma.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1790972556.json"
osbuild-composer-tests

Package

Name
osbuild-composer-tests
Purl
pkg:rpm/tuxcare/osbuild-composer-tests?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
76-2.el9_2.2.alma.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1790972556.json"
osbuild-composer-worker

Package

Name
osbuild-composer-worker
Purl
pkg:rpm/tuxcare/osbuild-composer-worker?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
76-2.el9_2.2.alma.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1790972556.json"