Junglewise Threat Intelligence

CVE-2026-27606: Rollup arbitrary file write via path traversal

CVE-2026-27606 · Severity: critical · CVSS 9.8 · Published 2026-02-25

Executive brief

Rollup is a widely used tool for bundling JavaScript code into single files for web development. A security flaw allows attackers to manipulate where files are saved during the build process, potentially overwriting critical system files. This could allow an attacker to gain permanent control over the computer or server running the build process, leading to data theft or service disruption.

Technical details

Rollup versions prior to 2.80.0, 3.30.0, and 4.59.0 contain a path traversal vulnerability (CWE-22) due to insecure file name sanitization in the core engine. An attacker can control output filenames through CLI named inputs, manual chunk aliases, or malicious plugins using traversal sequences (e.g., '../'). This allows the build process to overwrite files anywhere on the host filesystem that the process has permissions for. Successful exploitation can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Patches are available in versions 2.80.0, 3.30.0, and 4.59.0.

Affected products

  • Rollup Rollup < 2.80.0, < 3.30.0, < 4.59.0

Timeline

  • 2026-02-22: patched: Fixes committed to repository
  • 2026-02-25: disclosed: CVE published

References