CVE-2026-6636

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6636
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6636.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6636
Published
2026-04-20T12:00:17Z
Modified
2026-10-08T02:48:01Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
p2r3 convert API buildCache.js Bun.serve path traversal
Details

A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affected is the function Bun.serve of the file buildCache.js of the component API. Performing a manipulation of the argument pathname results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6636.json"
}
References

Affected packages

Git / github.com/dave-gilmore-aus/security-advisories

Affected ranges

Type
GIT
Repo
https://github.com/dave-gilmore-aus/security-advisories
Events
Introduced
6998584ace3e11db66dff0b423612a5cf91de75b
Last Affected
6998584ace3e11db66dff0b423612a5cf91de75b

Affected versions

Other
6998584ace3e11db66dff0b423612a5cf91de75b

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6636.json"