{"id":"CVE-2026-39408","aliases":["EUVD-2026-20495","GHSA-xf4j-xp2r-rqqx","ROOT-APP-NPM-CVE-2026-39408"],"status":"published","title":"Hono has a path traversal in toSSG() allows writing files outside the output directory","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00513,"percentile":0.44166,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-04-08T00:16:51Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"npm","package":"hono","fixed_in":["4.12.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.12.11"},{"fixed":"4.12.12"}]}]},{"source":"osv","ecosystem":"npm","package":"hono","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.12.12"}]}]}],"products":[{"vendor":"hono","product":"hono"},{"vendor":"honojs","product":"hono"}],"references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-xf4j-xp2r-rqqx","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/honojs/hono/commit/b470278920fffcfd6d76002755d6db53db827679","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/honojs/hono/releases/tag/v4.12.12","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39408","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xf4j-xp2r-rqqx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39408.json","tags":["advisory"]},{"url":"https://github.com/honojs/hono","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-39408","title":"Hono has a path traversal in toSSG() allows writing files outside the output directory","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.","status":"published","published":"2026-04-08T14:42:25.357Z","modified":"2026-04-10T20:31:47.508Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:02.662847Z"}],"euvd":[{"id":"EUVD-2026-20495","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.","status":"published","published":"2026-04-08T14:42:25Z","modified":"2026-04-10T20:31:47Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:24:29.371024Z"}],"ghsa":[{"id":"GHSA-xf4j-xp2r-rqqx","title":"Hono: Path traversal in toSSG() allows writing files outside the output directory","description":"## Summary\n\nA path traversal issue in `toSSG()` allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via `ssgParams`, specially crafted values can cause generated file paths to escape the intended output directory.\n\n## Details\n\nThe static site generation process creates output files based on route paths derived from application routes and parameters. When `ssgParams` is used to provide values for dynamic routes, those values are used to construct output file paths. If these values contain traversal sequences (e.g. `..`), the resulting output path may resolve outside the configured output directory. As a result, files may be written to unintended locations instead of being confined within the specified output directory.\n\nFor example:\n \n```ts\nimport { Hono } from 'hono'\nimport { toSSG, ssgParams } from 'hono/ssg'\n\nconst app = new Hono()\n\napp.get('/:id', ssgParams([{ id: '../pwned' }]), (c) =\u003e {\n  return c.text('pwned')\n})\n\ntoSSG(app, fs, { dir: './static' })\n```\n\nIn this case, the generated output path may resolve outside `./static`, resulting in a file being written outside the intended output directory.\n\n## Impact\n\nAn attacker who can influence values passed to `ssgParams` during the build process may be able to write files outside the intended output directory.\n\nDepending on the build and deployment environment, this may:\n\n* overwrite unintended files\n* affect generated artifacts\n* impact deployment outputs or downstream tooling\n\nThis issue is limited to build-time static site generation and does not affect request-time routing.","status":"published","published":"2026-04-08T00:16:51Z","modified":"2026-04-08T15:34:40Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:51.193071Z"}],"nvd":[{"id":"CVE-2026-39408","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.","status":"published","published":"2026-04-08T15:16:14.823Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:13.535987Z"}],"osv":[{"id":"CVE-2026-39408","title":"Hono has a path traversal in toSSG() allows writing files outside the output directory","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.","status":"published","published":"2026-04-08T14:42:25.357Z","modified":"2026-10-28T02:30:45.595772755Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"GHSA-xf4j-xp2r-rqqx","title":"Hono: Path traversal in toSSG() allows writing files outside the output directory","description":"## Summary\n\nA path traversal issue in `toSSG()` allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via `ssgParams`, specially crafted values can cause generated file paths to escape the intended output directory.\n\n## Details\n\nThe static site generation process creates output files based on route paths derived from application routes and parameters. When `ssgParams` is used to provide values for dynamic routes, those values are used to construct output file paths. If these values contain traversal sequences (e.g. `..`), the resulting output path may resolve outside the configured output directory. As a result, files may be written to unintended locations instead of being confined within the specified output directory.\n\nFor example:\n \n```ts\nimport { Hono } from 'hono'\nimport { toSSG, ssgParams } from 'hono/ssg'\n\nconst app = new Hono()\n\napp.get('/:id', ssgParams([{ id: '../pwned' }]), (c) =\u003e {\n  return c.text('pwned')\n})\n\ntoSSG(app, fs, { dir: './static' })\n```\n\nIn this case, the generated output path may resolve outside `./static`, resulting in a file being written outside the intended output directory.\n\n## Impact\n\nAn attacker who can influence values passed to `ssgParams` during the build process may be able to write files outside the intended output directory.\n\nDepending on the build and deployment environment, this may:\n\n* overwrite unintended files\n* affect generated artifacts\n* impact deployment outputs or downstream tooling\n\nThis issue is limited to build-time static site generation and does not affect request-time routing.","status":"published","published":"2026-04-08T00:16:51Z","modified":"2026-09-10T03:51:03.934940424Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"ROOT-APP-NPM-CVE-2026-39408","title":"CVE-2026-39408 in hono - Patched by Root","description":"Root has patched CVE-2026-39408 in the hono package for Root:npm. Multiple fixed versions available.","status":"withdrawn","published":"2026-07-27T08:20:49Z","modified":"2026-07-29T08:00:21.289079448Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}