CVE-2026-104871 · GHSA-7g7c-h8rr-7p6q
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
- Risk score
- 50/100
- CVSS
- 6.3 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-…
- Affected
- @angular/ssr (npm) >= 22.0.0, < 22.1.7; @angular/ssr (npm) >= 21.0.0, < 21.2.23; @angular/ssr (npm) >= 20.0.0, < 20.3.36; @angular/ssr (npm) <= 19.2.27
- Fix
- Upgrade @angular/ssr to 22.1.7 or 21.2.23 or 20.3.36 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.3 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @angular/ssr | npm | >= 22.0.0, < 22.1.7 | 22.1.7 |
| @angular/ssr | npm | >= 21.0.0, < 21.2.23 | 21.2.23 |
| @angular/ssr | npm | >= 20.0.0, < 20.3.36 | 20.3.36 |
| @angular/ssr | npm | <= 19.2.27 | No fix yet |
References
- https://github.com/advisories/GHSA-7g7c-h8rr-7p6q
- https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q
- https://nvd.nist.gov/vuln/detail/CVE-2026-104871
- https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2
- https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755
- https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841
- https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914
- https://github.com/angular/angular-cli/releases/tag/v20.3.36
- https://github.com/angular/angular-cli/releases/tag/v21.2.23
- https://github.com/angular/angular-cli/releases/tag/v22.1.7
Original description
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.
Last activity 2 Oct 2026. Patch Forecast updates every hour.