# CVE-2026-104871: Angular SSR path traversal via backslash on Windows

Source: https://junglewise.ai/threats/cve-2026-104871-the-angular-ssr-is-a-server-rise-rendering-tool-for-angular  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104871 · Severity: medium · CVSS 4 · Published 2026-10-02

Angular's server-side rendering engine for web applications contains a path-traversal vulnerability on Windows that allows unauthenticated attackers to retrieve prerendered HTML pages from sibling directories. An attacker can exploit this by crafting URLs with backslash separators to bypass directory containment checks and access pages outside the intended public directory.

Technologies: [Google @Angular/Ssr](https://junglewise.ai/threats/technologies/ssr), [@angular/ssr (npm)](https://junglewise.ai/threats/technologies/angular-ssr). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-104871 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104871 being exploited in the wild.

**How severe is CVE-2026-104871?** Medium severity, with a CVSS score of 4, published 2 October 2026.

**Which products and versions are affected?** Google @Angular/Ssr prior to 22.1.7; @angular/ssr (npm) SEMVER:introduced=22.0.0,fixed=22.1.7.

**Is there a fix for CVE-2026-104871?** Yes. @angular/ssr (npm): upgrade to 22.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104871 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104871?** Check whether you run Google @Angular/Ssr or @angular/ssr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/ssr (npm): upgrade to 22.1.7 or later

  ```sh
  npm install @angular/ssr@22.1.7
  ```


## Technical details

The CommonEngine.retrieveSSGPage function uses a simple string startsWith() check to validate that resolved file paths remain within the configured publicPath, but this check fails to account for Windows backslash path separators and sibling directories with matching name prefixes. An unauthenticated attacker can supply relative URLs containing backslash parent-traversal segments; the resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the containment check incorrectly accepts a sibling directory whose name shares the publicPath prefix. The vulnerability only affects Windows deployments that pass relative request URLs to CommonEngine.render and have prefix-sharing sibling output directories containing prerendered Angular HTML.

## Affected products

- Google @angular/ssr 17 through 18
- Google @angular/ssr prior to 20.3.36
- Google @angular/ssr prior to 21.2.23
- Google @angular/ssr prior to 22.1.7

## Identifiers

- CVE-2026-104871
- GHSA-7g7c-h8rr-7p6q

## Timeline

- 2026-10-02: disclosed

## References

- [https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2](https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2)
- [https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755](https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755)

## Related threats

- [Angular SSR path traversal in X-Forwarded-Prefix header](https://junglewise.ai/threats/cve-2026-44437-angular-ssr-path-traversal-in-x-forwarded-prefix-header)
- [Angular SSR protocol-relative URL injection via backslash bypass](https://junglewise.ai/threats/cve-2026-33397-angular-ssr-protocol-relative-url-injection-via-backslash-bypass)
- [Angular SSR SSRF and header injection in request handling](https://junglewise.ai/threats/cve-2026-27739-angular-ssr-ssrf-and-header-injection-in-request-handling)
- [Angular SSR open redirect via X-Forwarded-Prefix header](https://junglewise.ai/threats/cve-2026-27738-angular-ssr-open-redirect-via-x-forwarded-prefix-header)
- [Angular SSR server-side request forgery in URL resolution](https://junglewise.ai/threats/cve-2025-62427-angular-ssr-server-side-request-forgery-in-url-resolution)