CVE-2026-92812
Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching
CVSS Score
9.8
EPSS Score
0.4%
EPSS Percentile
38th
Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
| CWE | CWE-22 |
| Vendor | decaporg |
| Product | decap-cms |
| Published | Sep 16, 2026 |
| Last Updated | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for decaporg decap-cms
Be the first to know when new critical vulnerabilities affecting decaporg decap-cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
decaporg / decap-cms
0 < 3.11.0
References
github.com: https://github.com/decaporg/decap-cms/security/advisories/GHSA-5rrq-v82w-qpfr github.com: https://github.com/geo-chen/oss/blob/main/decap-cms.md github.com: https://github.com/decaporg/decap-cms/releases?page=2#[email protected] vulncheck.com: https://www.vulncheck.com/advisories/decap-cms-path-traversal-via-sibling-directory-prefix-matching
Credits
lalalala5678 George Chen tk-gamefactory