CVE-2026-102657

HIGH 7.5

esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application directory. URL-encoded dot segments such as %2e%2e bypass the plain traversal redirect performed by Go's ServeMux, allowing an unauthenticated remote attacker to make the server open and return files outside Config.AppDir that are readable by the server process. The confirmed impact is file disclosure only, and the issue is reachable with Dev disabled. This issue is fixed in server version 137_7.

CWE	CWE-22
Vendor	esm-dev
Product	esm.sh
Published	Nov 6, 2026

Stay Ahead of the Next One

Get instant alerts for esm-dev esm.sh

Be the first to know when new high vulnerabilities affecting esm-dev esm.sh are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

esm-dev / esm.sh

< 137_7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/esm-dev/esm.sh/security/advisories/GHSA-g3c2-rjq2-c763 github.com: https://github.com/esm-dev/esm.sh/pull/1376 github.com: https://github.com/esm-dev/esm.sh/commit/468b6b2a4b4dfec334cf6b33b01fcd4e5cd93bed github.com: https://github.com/esm-dev/esm.sh/commit/fc3b345e73aeaa0b7a05b6f27d91c05fdf5f9b53 github.com: https://github.com/esm-dev/esm.sh/releases/tag/v137_7