CVE-2026-106108

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-106108
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106108.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-106108
Aliases
Published
2026-10-13T14:55:50Z
Modified
2026-10-14T10:30:39Z
Severity
  • 5.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Details

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions. Application configuration and SSG page definitions are trusted by default, so exploitation requires a build process that derives them from external or otherwise less-trusted content; existing files remain protected by the renderer's no-overwrite behavior. This issue is fixed in version 3.3.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106108.json"
}
References

Affected packages

Git / github.com/quasarframework/quasar

Affected ranges

Type
GIT
Repo
https://github.com/quasarframework/quasar
Events
Introduced
1bae220c1205e28b31d54621c8954a05947224bb
Fixed
db082a4407936be7865c7c85dd1862bb213f0c08
Introduced
2b775e36028423061bf49a189195053a072b4ae2
Fixed
605f4da74c54bd3c3f3a22350396ca8c1ee0e084
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.22.0"
        },
        {
            "fixed":  "2.23.3"
        },
        {
            "introduced":  "3.1.0"
        },
        {
            "fixed":  "3.3.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

@quasar/app-vite-v3.*
@quasar/app-vite-v3.1.0
@quasar/app-vite-v3.2.0
@quasar/icongenie-v6.*
@quasar/icongenie-v6.1.2
quasar-v2.*
quasar-v2.22.0
quasar-v2.23.0
quasar-v2.23.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106108.json"