CVE-2026-48049 json
@hapi/inert: Static-file confinement bypass via sibling-prefix path
published 2026-06-11 4 mo ago modified 2026-10-24 15 d ago also EUVD-2026-45341 , GHSA-rcvq-m9j9-6f4g
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.
Patch / fix
- npm @hapi/inert 7.1.1
- hapi inert 7.1.1
- github.com/hapijs/inert@bcceb76 commit
- github.com/hapijs/inert@a65e5b2 commit
- github.com/hapijs/inert#176 pull request
- github.com/hapijs/inert/releases/tag/v7.1.1 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @hapi/inert | >=4.0.0, <7.1.1 |
7.1.1 |
Affected products
- hapijs inert
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/hapijs/inert/pull/176
web
- github.com /hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9
-
github.com
/hapijs/inert/commit/a65e5b271b5c3405af463469959c5e052eb23a62
web
-
github.com
/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g
web
- github.com /hapijs/inert/releases/tag/v7.1.1
-
github.com
/hapijs/inert
package
Sources
- CVE List CVE-2026-48049
- GitHub Advisory GHSA-rcvq-m9j9-6f4g
- NVD CVE-2026-48049
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.