CVE-2026-104871

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104871
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104871.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104871
Aliases
Published
2026-10-02T19:43:50Z
Modified
2026-10-04T02:46:04Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Details

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104871.json"
}
References

Affected packages

Git / github.com/angular/angular-cli

Affected ranges

Type
GIT
Repo
https://github.com/angular/angular-cli
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
a06ccb3f5f20364bfd0ff47269ac63824652d118
Introduced
9b15fa6d7c257cdf13ccc7e3bdb5723ff334dd6a
Fixed
a9f4dae68fb02e936b2bcae5f2e190296935194c
Fixed
e2582bb34e94457007c4c60b46436abd883d0630
Fixed
7e133c422a0776a4cf68d9636d9b778a845b9f06
Fixed
645e41a47d21b7651837a4250de99af0509626e2
Fixed
70748ca8e76fe4b42798719410336119d943e755
Fixed
bb72145f9ab45aee29f523236b3a25cd0813a841
Fixed
c3e5982e49705f0f6a913cb94622b4c555d2d914
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "20.3.36"
        },
        {
            "introduced":  "21.0.0"
        },
        {
            "fixed":  "21.2.23"
        },
        {
            "introduced":  "22.0.0"
        },
        {
            "fixed":  "22.1.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.20
0.0.21
0.0.22
0.0.23
0.0.24
0.0.25
1.*
1.0.0-beta.9
12.*
12.2.0-next.3
13.*
13.0.0-next.0
13.0.0-next.1
13.0.0-next.2
13.0.0-next.3
13.0.0-next.4
13.0.0-next.5
13.0.0-next.6
13.0.0-next.7
13.0.0-next.8
13.1.0-next.0
13.1.0-next.1
13.1.0-next.2
13.1.0-next.3
13.2.0-next.0
13.2.0-next.1
13.2.0-next.2
14.*
14.0.0-next.0
14.0.0-next.1
14.0.0-next.10
14.0.0-next.11
14.0.0-next.12
14.0.0-next.2
14.0.0-next.3
14.0.0-next.4
14.0.0-next.5
14.0.0-next.6
14.0.0-next.7
14.0.0-next.8
14.0.0-next.9
14.1.0-next.0
14.1.0-next.1
14.1.0-next.2
14.1.0-next.3
14.1.0-next.4
14.2.0-next.0
14.2.0-next.1
14.2.0-next.2
15.*
15.0.0-next.0
15.0.0-next.1
15.0.0-next.2
15.0.0-next.3
15.0.0-next.4
15.1.0-next.0
15.1.0-next.1
15.1.0-next.2
15.1.0-next.3
15.2.0-next.0
15.2.0-next.1
15.2.0-next.2
15.2.0-next.3
15.2.0-next.4
16.*
16.0.0-next.0
16.0.0-next.1
16.0.0-next.2
16.0.0-next.3
16.0.0-next.4
16.0.0-next.5
16.0.0-next.6
16.1.0-next.0
16.1.0-next.1
16.1.0-next.2
16.2.0-next.0
16.2.0-next.1
16.2.0-next.2
16.2.0-next.3
16.2.0-next.4
17.*
17.0.0-next.0
17.0.0-next.1
17.0.0-next.2
17.0.0-next.3
17.0.0-next.5
17.0.0-next.6
17.0.0-next.7
17.0.0-next.8
17.0.0-next.9
17.1.0-next.0
17.1.0-next.1
17.1.0-next.2
17.1.0-next.3
17.2.0-next.0
17.2.0-next.1
18.*
18.0.0-next.0
18.0.0-next.1
18.0.0-next.2
18.0.0-next.3
18.0.0-next.4
18.1.0-next.0
18.1.0-next.1
18.1.0-next.2
18.1.0-next.3
18.2.0-next.0
18.2.0-next.1
18.2.0-next.2
18.2.0-next.3
19.*
19.0.0-next.0
19.0.0-next.1
19.0.0-next.10
19.0.0-next.11
19.0.0-next.12
19.0.0-next.2
19.0.0-next.3
19.0.0-next.4
19.0.0-next.5
19.0.0-next.6
19.0.0-next.7
19.0.0-next.8
19.0.0-next.9
19.1.0-next.0
19.1.0-next.1
19.1.0-next.2
19.2.0-next.0
19.2.0-next.1
19.2.0-next.2
20.*
20.0.0-next.0
20.0.0-next.1
20.0.0-next.2
20.0.0-next.3
20.0.0-next.4
20.0.0-next.5
20.0.0-next.6
20.0.0-next.7
20.0.0-next.8
20.1.0-next.0
20.1.0-next.1
20.1.0-next.2
20.1.0-next.3
20.2.0
20.2.0-next.0
20.2.0-next.1
20.2.0-next.2
20.2.0-next.3
20.2.0-rc.0
20.2.0-rc.1
20.2.1
20.2.2
20.3.0
20.3.0-rc.0
20.3.1
20.3.10
20.3.11
20.3.12
20.3.13
20.3.2
20.3.3
20.3.4
20.3.5
20.3.6
20.3.7
20.3.8
20.3.9
21.*
21.0.0-next.0
21.0.0-next.1
21.0.0-next.2
21.0.0-next.3
21.0.0-next.4
21.0.0-next.5
21.0.0-next.6
21.0.0-next.7
21.0.0-next.8
21.1.0-next.0
21.1.0-next.1
9.*
9.0.0-next.7
v0.*
v0.0.27
v0.0.29
v0.0.30
v0.0.31
v0.0.33
v0.0.34
v0.0.35
v0.0.37
v0.0.39
v0.1.0
v1.*
v1.0.0
v1.0.0-beta.0
v1.0.0-beta.1
v1.0.0-beta.10
v1.0.0-beta.10-webpack
v1.0.0-beta.11-webpack.2
v1.0.0-beta.14
v1.0.0-beta.15
v1.0.0-beta.17
v1.0.0-beta.18
v1.0.0-beta.19
v1.0.0-beta.2-mobile
v1.0.0-beta.2-mobile.3
v1.0.0-beta.20-1
v1.0.0-beta.21
v1.0.0-beta.22
v1.0.0-beta.22-1
v1.0.0-beta.23
v1.0.0-beta.26
v1.0.0-beta.28
v1.0.0-beta.30
v1.0.0-beta.31
v1.0.0-beta.32
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.0.0-rc.0
v1.0.0-rc.1
v1.0.0-rc.2
v1.0.0-rc.4
v1.0.1
v1.4.0-beta.1
v1.5.0-beta.0
v10.*
v10.0.0-next.0
v10.0.0-next.1
v10.0.0-next.2
v10.0.0-next.3
v10.0.0-next.4
v10.0.0-next.5
v10.0.0-next.6
v10.0.0-rc.0
v10.1.0-next.0
v10.1.0-next.1
v10.1.0-next.2
v10.1.0-next.3
v10.1.0-next.4
v10.1.0-next.5
v10.1.0-next.6
v10.1.0-next.7
v11.*
v11.0.0-next.0
v11.0.0-next.1
v11.0.0-next.2
v11.0.0-next.3
v11.0.0-next.4
v11.0.0-next.5
v11.0.0-next.6
v11.0.0-next.7
v11.1.0-next.0
v11.1.0-next.1
v11.1.0-next.2
v11.1.0-next.3
v11.1.0-next.4
v11.2.0-next.0
v12.*
v12.0.0-next.0
v12.0.0-next.1
v12.0.0-next.2
v12.0.0-next.3
v12.0.0-next.4
v12.0.0-next.5
v12.0.0-next.6
v12.0.0-next.7
v12.0.0-next.8
v12.0.0-next.9
v12.1.0
v12.1.0-next.2
v12.1.0-next.3
v12.1.0-next.4
v12.1.0-next.5
v12.1.0-next.6
v12.2.0-next.0
v12.2.0-next.1
v12.2.0-next.2
v20.*
v20.3.14
v20.3.15
v20.3.16
v20.3.17
v20.3.18
v20.3.19
v20.3.20
v20.3.21
v20.3.22
v20.3.23
v20.3.24
v20.3.25
v20.3.26
v20.3.27
v20.3.28
v20.3.29
v20.3.30
v20.3.31
v20.3.32
v20.3.33
v20.3.34
v20.3.35
v21.*
v21.1.0-next.2
v21.1.0-next.3
v21.2.0
v21.2.0-next.0
v21.2.0-next.1
v21.2.0-next.2
v21.2.0-rc.0
v21.2.0-rc.1
v21.2.0-rc.2
v21.2.1
v21.2.10
v21.2.11
v21.2.12
v21.2.13
v21.2.14
v21.2.15
v21.2.16
v21.2.17
v21.2.18
v21.2.19
v21.2.2
v21.2.20
v21.2.21
v21.2.22
v21.2.3
v21.2.4
v21.2.5
v21.2.6
v21.2.7
v21.2.8
v21.2.9
v22.*
v22.0.0-next.0
v22.0.0-next.1
v22.0.0-next.2
v22.0.0-next.3
v22.0.0-next.4
v22.0.0-next.5
v22.0.0-next.6
v22.0.0-next.7
v22.0.0-next.8
v22.1.0
v22.1.0-next.0
v22.1.0-next.1
v22.1.0-next.2
v22.1.0-next.3
v22.1.0-next.4
v22.1.0-rc.0
v22.1.1
v22.1.2
v22.1.3
v22.1.4
v22.1.5
v22.1.6
v22.2.0-next.0
v22.2.0-next.1
v22.2.0-next.2
v22.2.0-next.3
v22.2.0-next.4
v22.2.0-next.5
v6.*
v6.0.0
v6.0.0-beta.3
v6.0.0-beta.5
v6.0.0-beta.6
v6.0.0-beta.7
v6.0.0-beta.8
v6.0.0-beta.9
v6.0.0-rc.0
v6.0.0-rc.1
v6.0.0-rc.10
v6.0.0-rc.2
v6.0.0-rc.3
v6.0.0-rc.4
v6.0.0-rc.5
v6.0.0-rc.6
v6.0.0-rc.7
v6.0.0-rc.9
v6.2.0-beta.0
v6.2.0-beta.1
v6.2.0-beta.2
v6.2.0-beta.3
v6.2.0-rc.0
v7.*
v7.0.0-beta.2
v7.0.0-beta.3
v7.0.0-beta.4
v7.0.0-rc.0
v7.0.0-rc.2
v7.0.0-rc.3
v7.1.0-beta.0
v7.1.0-beta.1
v7.1.0-rc.0
v7.2.0-beta.0
v7.2.0-beta.1
v7.2.0-beta.2
v7.2.0-rc.0
v7.3.0-beta.0
v7.3.0-rc.0
v8.*
v8.0.0-beta.0
v8.0.0-beta.1
v8.0.0-beta.10
v8.0.0-beta.11
v8.0.0-beta.12
v8.0.0-beta.13
v8.0.0-beta.14
v8.0.0-beta.15
v8.0.0-beta.16
v8.0.0-beta.17
v8.0.0-beta.18
v8.0.0-beta.2
v8.0.0-beta.3
v8.0.0-beta.4
v8.0.0-beta.5
v8.0.0-beta.6
v8.0.0-beta.7
v8.0.0-beta.8
v8.0.0-beta.9
v8.1.0
v8.1.0-beta.0
v8.1.0-beta.1
v8.1.0-beta.2
v8.1.0-beta.3
v8.1.0-rc.0
v8.2.0-next.0
v8.2.0-next.1
v8.2.0-next.2
v8.2.0-rc.0
v8.3.0-next.0
v8.3.0-next.1
v8.3.0-next.2
v8.3.0-rc.0
v9.*
v9.0.0-next.0
v9.0.0-next.1
v9.0.0-next.10
v9.0.0-next.11
v9.0.0-next.12
v9.0.0-next.13
v9.0.0-next.14
v9.0.0-next.15
v9.0.0-next.16
v9.0.0-next.17
v9.0.0-next.18
v9.0.0-next.19
v9.0.0-next.2
v9.0.0-next.3
v9.0.0-next.4
v9.0.0-next.5
v9.0.0-next.6
v9.0.0-next.7
v9.0.0-next.8
v9.0.0-next.9
v9.1.0-next.0
v9.1.0-next.1
v9.1.0-next.2
v9.1.0-next.3
v9.1.0-next.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104871.json"