CVE-2026-48049

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48049
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48049.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48049
Aliases
Downstream
Related
Published
2026-07-17T21:03:16Z
Modified
2026-08-12T03:51:38Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
@hapi/inert: Static-file confinement bypass via sibling-prefix path
Details

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48049.json"
}
References

Affected packages

Git / github.com/hapijs/inert

Affected ranges

Type
GIT
Repo
https://github.com/hapijs/inert
Events
Introduced
c4f6b07e3864e7d0883b4f7a5675cb2e47a2096e
Fixed
bcceb761a43b9d1178eb6bd553e4ad2bb70494d9
Fixed
9cd9da9f6535fb9c862f9b9e67386ed6bd92bb45
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "7.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.1.0
v4.2.0
v4.2.1
v5.*
v5.0.0
v5.0.0-rc1
v5.0.0-rc4
v5.0.0-rc5
v5.0.0-rc7
v5.0.0-rc8
v5.0.1
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.2.0
v5.2.1
v5.2.2
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v7.*
v7.0.0
v7.0.1
v7.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48049.json"