Executive brief
Pode is a web framework used to build websites and APIs using PowerShell. A security flaw in how the framework handles file requests allows unauthorized users to access sensitive files on the host server that should be restricted. This could lead to the exposure of system configuration files, credentials, or other private data, depending on the permissions of the account running the application.
Technical details
A directory traversal vulnerability (CWE-22) exists in the 'Add-PodeStaticRoute' component of the Pode framework. The vulnerability arises from insufficient validation of URI paths when requesting content from a Static Route, allowing an attacker to bypass the intended source directory by supplying absolute paths or traversal sequences (e.g., requesting 'c:/Windows/System32/drivers/etc/hosts' directly via the web port). This allows a remote, unauthenticated attacker to read arbitrary files on the underlying file system, subject to the permissions of the PowerShell process owner. The issue is resolved in version 2.13.0 by properly restricting file access to the defined Source path.
Affected products
- Badgerati Pode >= 2.4.0, < 2.13.0
Timeline
- 2026-03-26: other: Issue reported to developer
- 2026-05-01: advisory: GitHub security advisory published
- 2026-05-14: disclosed: CVE published to NVD
- 2026-05-14: patched: Fix released in version 2.13.0