{"id":"CVE-2026-48049","aliases":["EUVD-2026-45341","GHSA-rcvq-m9j9-6f4g","ROOT-APP-NPM-CVE-2026-48049"],"status":"published","title":"@hapi/inert: Static-file confinement bypass via sibling-prefix path","description":"@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0059,"percentile":0.48675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-06-11T17:10:15Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"npm","package":"@hapi/inert","fixed_in":["7.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@rootio/hapi__inert","fixed_in":["6.0.5-root.io.1","7.1.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@hapi/inert","fixed_in":["6.0.5-aikido.1","7.1.0-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@hapi/inert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"7.1.0"},{"fixed":"7.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@hapi/inert","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"7.1.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/hapi__inert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.5-root.io.1"},{"fixed":"7.1.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@hapi/inert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.5-aikido.1"},{"fixed":"7.1.0-aikido.1"}]}]}],"products":[{"vendor":"hapijs","product":"inert"}],"references":[{"url":"https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/hapijs/inert/pull/176","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/hapijs/inert/releases/tag/v7.1.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/hapijs/inert/commit/a65e5b271b5c3405af463469959c5e052eb23a62","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rcvq-m9j9-6f4g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48049.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48049","tags":["advisory"]},{"url":"https://github.com/hapijs/inert","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48049","title":"@hapi/inert: Static-file confinement bypass via sibling-prefix path","description":"@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.","status":"published","published":"2026-07-17T21:03:16.577Z","modified":"2026-07-21T02:26:04.404Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-45341","description":"@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.","status":"published","published":"2026-07-17T21:03:16Z","modified":"2026-07-21T02:26:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:47.959089Z"}],"ghsa":[{"id":"GHSA-rcvq-m9j9-6f4g","title":"@hapi/inert has a static-file confinement bypass via sibling-prefix path","description":"### Impact\n`@hapi/inert` serves static files from a directory configured with `path` (in the `directory` / `file` handlers) or `relativeTo` (for `h.file()`), with confinement enforced by the `confine` option (default `true`). Before the patch, the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory whose absolute path begins with the same characters as the confine directory (eg. `/app/static-secret` next to a served `/app/static`) was incorrectly accepted as confined. An unauthenticated remote attacker who knows or guesses such a sibling name can read any file inside it via a request like `/..%2fstatic-secret/secret.txt`, provided the file is readable by the server process. Only applications that happen to have a sibling directory sharing a string prefix with the served directory are exploitable; applications with no such sibling are unaffected.\n\n### Patches\nUpgrade to 7.1.1.\n\n### Workarounds\nFor users who cannot upgrade immediately: ensure the directory served via inert has no sibling whose name starts with the same characters (for example, rename `static-secret/` to `secret/`, or move it to a different parent directory).\n\n### Resources\nPull Request: https://github.com/hapijs/inert/pull/176","status":"published","published":"2026-06-11T17:10:15Z","modified":"2026-06-11T17:10:16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:40:26.12116Z"}],"nvd":[{"id":"CVE-2026-48049","description":"@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.","status":"published","published":"2026-07-17T22:17:14.557Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:30.631352Z"}],"osv":[{"id":"CVE-2026-48049","title":"@hapi/inert: Static-file confinement bypass via sibling-prefix path","description":"@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.","status":"published","published":"2026-07-17T21:03:16.577Z","modified":"2026-10-28T02:30:39.223741216Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-rcvq-m9j9-6f4g","title":"@hapi/inert has a static-file confinement bypass via sibling-prefix path","description":"### Impact\n`@hapi/inert` serves static files from a directory configured with `path` (in the `directory` / `file` handlers) or `relativeTo` (for `h.file()`), with confinement enforced by the `confine` option (default `true`). Before the patch, the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory whose absolute path begins with the same characters as the confine directory (eg. `/app/static-secret` next to a served `/app/static`) was incorrectly accepted as confined. An unauthenticated remote attacker who knows or guesses such a sibling name can read any file inside it via a request like `/..%2fstatic-secret/secret.txt`, provided the file is readable by the server process. Only applications that happen to have a sibling directory sharing a string prefix with the served directory are exploitable; applications with no such sibling are unaffected.\n\n### Patches\nUpgrade to 7.1.1.\n\n### Workarounds\nFor users who cannot upgrade immediately: ensure the directory served via inert has no sibling whose name starts with the same characters (for example, rename `static-secret/` to `secret/`, or move it to a different parent directory).\n\n### Resources\nPull Request: https://github.com/hapijs/inert/pull/176","status":"published","published":"2026-06-11T17:10:15Z","modified":"2026-09-10T03:50:50.445011616Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"ROOT-APP-NPM-CVE-2026-48049","title":"CVE-2026-48049 in @rootio/hapi__inert - Patched by Root","description":"Root has patched CVE-2026-48049 in the @rootio/hapi__inert package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-13T09:16:08Z","modified":"2026-07-13T13:15:16.637455199Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}