{"id":"CVE-2026-63225","aliases":["EUVD-2026-81013","GHSA-657c-g7qc-r9j2"],"status":"published","title":"Redocly CLI: Path traversal when using `split` command","description":"Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00179,"percentile":0.0757,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-73"],"published":"2026-09-16T19:09:00Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"npm","package":"@redocly/cli","fixed_in":["1.34.17","2.33.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@redocly/cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.17"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@redocly/cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.33.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@redocly/cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.34.17"}]}]},{"source":"osv","ecosystem":"npm","package":"@redocly/cli","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.33.2"}]}]}],"products":[{"vendor":"redocly","product":"redocly-cli"}],"references":[{"url":"https://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/Redocly/redocly-cli/pull/2891","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Redocly/redocly-cli/pull/2923","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63225","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-657c-g7qc-r9j2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63225.json","tags":["advisory"]},{"url":"https://github.com/Redocly/redocly-cli","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-63225","title":"Redocly CLI: Path traversal when using `split` command","description":"Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.","status":"published","published":"2026-09-16T19:09:00.593Z","modified":"2026-09-17T16:13:49.405Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-81013","description":"Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.","status":"published","published":"2026-09-16T19:09:00Z","modified":"2026-09-17T16:13:49Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:11.273554Z"}],"ghsa":[{"id":"GHSA-657c-g7qc-r9j2","title":"Redocly CLI: Path traversal when using `split` command","description":"### Impact\n\nAn OpenAPI or AsyncAPI description could make the `split` command write\nfiles outside the chosen output directory, on the machine of anyone who runs\n`split` against it. The write is constrained rather than a free file-write\nprimitive: component data is emitted only as YAML/JSON, and code-sample files are\nnamed after the HTTP method, so an attacker can place or overwrite files at an\nunintended path but has limited control over their name and contents.\n\n### Patches\n\nFixed in `@redocly/cli` v2.33.2.\n\n### Workarounds\n\nDo not run the `split` command on API descriptions from untrusted or unreviewed sources.\n\nTo detect an exploit attempt, inspect the description's component names and\n`x-codeSamples` `lang` values for a literal `../` — neither legitimately contains\npath segments.","status":"published","published":"2026-09-17T14:58:50Z","modified":"2026-09-17T14:58:52Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:41:17.136201Z"}],"nvd":[{"id":"CVE-2026-63225","description":"Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.","status":"published","published":"2026-09-16T19:17:24.163Z","modified":"2026-09-30T17:51:36.337Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:12:48.630594Z"}],"osv":[{"id":"CVE-2026-63225","title":"Redocly CLI: Path traversal when using `split` command","description":"Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.","status":"published","published":"2026-09-16T19:09:00.593Z","modified":"2026-10-28T02:30:55.576475327Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"GHSA-657c-g7qc-r9j2","title":"Redocly CLI: Path traversal when using `split` command","description":"### Impact\n\nAn OpenAPI or AsyncAPI description could make the `split` command write\nfiles outside the chosen output directory, on the machine of anyone who runs\n`split` against it. The write is constrained rather than a free file-write\nprimitive: component data is emitted only as YAML/JSON, and code-sample files are\nnamed after the HTTP method, so an attacker can place or overwrite files at an\nunintended path but has limited control over their name and contents.\n\n### Patches\n\nFixed in `@redocly/cli` v2.33.2.\n\n### Workarounds\n\nDo not run the `split` command on API descriptions from untrusted or unreviewed sources.\n\nTo detect an exploit attempt, inspect the description's component names and\n`x-codeSamples` `lang` values for a literal `../` — neither legitimately contains\npath segments.","status":"published","published":"2026-09-17T14:58:50Z","modified":"2026-09-17T16:32:22.063735184Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T15:46:39.266402Z"}]}}