VDB

RHSA-2026:61783

RHSA-2026:61783 PUBLISHED CVSS 8.600000381469727 HIGH

A flaw was found in the webpack-dev-middleware package, where it failed to validate the supplied URL address sufficiently before returning local files. This flaw allows an attacker to craft URLs to return arbitrary local files from the developer's machine. The lack of normalization before calling the middleware also allows the attacker to perform path traversal attacks on the target environment.

Risk Scores

CVSS 3.1
8.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected Products

VendorProductVersions
Red Hatregistry.redhat.io/discovery/discovery-ui-rhel9@sha256:480c69f89b45c714ec13a7901bc8615a2fa3f4622c889cd023d80a6278855a58_arm64 as a component of Red Hat Discovery 2*, *
Red Hatregistry.redhat.io/discovery/discovery-server-rhel9@sha256:5efae8059c9c15454abac947b8482412686d60aaf5c104557d463e8282e340af_amd64 as a component of Red Hat Discovery 2*, *
Red Hatregistry.redhat.io/discovery/discovery-server-rhel9@sha256:e9592a7aa5db3a61a7248d7b0305f3eb2fae189b1d078e483f1cc439f5b2351d_arm64 as a component of Red Hat Discovery 2*, *
Red Hatregistry.redhat.io/discovery/discovery-ui-rhel9@sha256:def96951197558d6c5d1784a7971b0e37b44025c60d9b59fe6797085e39c382a_amd64 as a component of Red Hat Discovery 2*, *

Timeline

  • Aug 31, 2026 CVE Published
  • Sep 7, 2026 CVE Updated
  • Sep 7, 2026 Distribution Patch
  • Sep 7, 2026 Distribution Patch
  • Sep 7, 2026 Security Advisory
  • Sep 7, 2026 Security Advisory
  • Sep 7, 2026 Security Advisory
  • Sep 7, 2026 Security Advisory
  • Sep 7, 2026 Security Advisory
  • Sep 7, 2026 Security Advisory
  • Sep 7, 2026 Security Advisory
  • Sep 7, 2026 Security Advisory

References

…and 226 more

Open in Interactive Console →
$ Console Community · 50/day Open console ›