{"uuid": "25d0c039-a49e-4705-9952-c88e174e8647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76844", "type": "seen", "source": "https://gist.github.com/alon710/1be672ce71aee9657c829c111ce0d806", "content": "# CVE-2026-76844: CVE-2026-76844: Path Traversal in webpack-dev-middleware via Incomplete Prefix Validation\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76844\n\n## Summary\nCVE-2026-76844 is a high-severity path traversal vulnerability in webpack-dev-middleware affecting multiple version branches. It stems from an incomplete fix for CVE-2024-29180 when serving files via a physical filesystem with a non-slash-terminated publicPath configuration. Attackers can bypass directory validation to access files situated one level above the intended output directory.\n\n## TL;DR\nwebpack-dev-middleware suffers from a path traversal flaw when publicPath lacks a trailing slash and physical files are served, allowing attackers to read files one directory above the output root via crafted HTTP requests like GET /assets../.env.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22 (Path Traversal)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.4 (High)\n- **EPSS Score**: 0.00483\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- webpack-dev-middleware versions 5.3.4, 6.1.2-6.1.3, 7.1.0-7.4.5, 8.0.0-8.1.1 configured with writeToDisk or custom physical outputFileSystem\n- **webpack-dev-middleware**: >= 5.3.4, <= 8.1.1 (Fixed in: `7.4.6, 8.3.0`)\n\n## Mitigation\n\n- Upgrade webpack-dev-middleware to a non-vulnerable version (7.4.6+ or 8.3.0+).\n- Append a trailing slash to the configured publicPath parameter to ensure precise prefix matching.\n\n**Remediation Steps:**\n1. Identify the version of webpack-dev-middleware installed in your package-lock.json or yarn.lock file.\n2. Update your dependencies using 'npm install webpack-dev-middleware@7.4.6' or 'npm update webpack-dev-middleware'.\n3. Inspect the webpack configuration file (webpack.config.js) and verify that 'output.publicPath' terminates with a trailing slash (e.g., '/static/' instead of '/static').\n4. Restart your development server to load the updated middleware logic.\n\n## References\n\n- [GitHub Security Advisory GHSA-wr3j-pwj9-hqq6](https://github.com/advisories/GHSA-wr3j-pwj9-hqq6)\n- [webpack-dev-middleware Middleware Source File](https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js)\n- [VulnCheck Advisory for webpack-dev-middleware](https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath)\n- [Fix Commit 1 (v8.x/v7.x)](https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b)\n- [Fix Commit 2](https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76844) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T17:30:31.000000Z"}