Executive brief
Logto's tunnel service is a CLI tool that serves custom authentication UI files from a specified directory. Due to inadequate path validation, an attacker on the network can craft requests using path traversal sequences (../) to read sensitive files stored on the same system where the tunnel is running, such as API keys, credentials, or environment secrets. This is particularly risky in development environments where the tunnel port may be exposed.
Technical details
The vulnerability is a path traversal flaw in @logto/tunnel's static file proxy implementation. The vulnerable code in packages/tunnel/src/commands/tunnel/utils.ts constructs filesystem paths by directly concatenating the request URL to the configured --experience-path using path.join(), then opens the resolved file with fs.open() without validating that the final path remains within the intended directory. An attacker can send an HTTP request with a URL like /../secret.txt, which resolves outside the static directory boundary and allows reading arbitrary files. The tunnel server binds to all network interfaces by default (server.listen(port)), making it reachable from the network. No authentication is required. A successful exploit results in arbitrary file read of any file accessible to the tunnel process, potentially exposing development secrets, API keys, or credentials stored near the custom UI project directory.
Affected products
- Logto @logto/tunnel <= 0.3.8
Timeline
- 2026-07-02: disclosed
- 2026-08-19: advisory
- 2026-08-19: patched: Fixed in version 0.3.9