CVE-2026-92812

CVSS 9.8 (critical) · published 2026-09-16

Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.

Weakness: CWE-22

Source: NVD CVE-2026-92812

References

• https://github.com/decaporg/decap-cms/releases?page=2#[email protected]
• https://github.com/decaporg/decap-cms/security/advisories/GHSA-5rrq-v82w-qpfr
• https://github.com/geo-chen/oss/blob/main/decap-cms.md
• https://www.vulncheck.com/advisories/decap-cms-path-traversal-via-sibling-directory-prefix-matching

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.