Executive brief
Decap Server is a Git-based CMS backend that manages content for static site generators. A path traversal vulnerability in its local proxy containment guard allows attackers to read, write, or delete files outside the intended repository directory by exploiting weak path validation logic that fails to check directory boundaries properly.
Technical details
The vulnerability exists in the pathTraversal validator (customValidators.ts) which uses a plain string prefix comparison (startsWith) without proper path separator validation. An attacker can craft paths that pass this check but resolve to sibling directories—for example, if the repository is at /repo, a path like ../repo-sibling would pass validation because the resolved path starts with "/repo" as a substring. This allows unauthorized file system access via the local proxy. The vulnerability requires network access to the Decap Server API endpoint and does not require authentication. An attacker can achieve arbitrary read, write, and delete operations on files outside the repository root.
Affected products
- Decap decap-server
Timeline
- 2026-09-16: disclosed