CVE-2026-106108

Deferred Deferred - Pending Action

Path Traversal in Quasar Framework

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions. Application configuration and SSG page definitions are trusted by default, so exploitation requires a build process that derives them from external or otherwise less-trusted content; existing files remain protected by the renderer's no-overwrite behavior. This issue is fixed in version 3.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106108

EUVD

EUVD-2026-98736

Affected Vendors & Products

Vendor	Product	Version / Range
quasarframework	quasar	>= 2.22.0, < 2.23.3
@quasar	app-vite	>= 3.1.0, < 3.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Quasar Framework versions 3.1.0 to 3.3.0 had a vulnerability in the SSG page definitions where dir and filename values could be manipulated to create files or directories outside the intended build directory. This happened because the framework did not verify the final destination path when joining these values to build.distDir. Exploitation required a build process that derived page definitions from untrusted content.

Detection Guidance

To detect this vulnerability, check if your Quasar Framework version is between 3.1.0 and 3.2.0. Run: npm list @quasar/app-vite. If the version is in this range, the system is vulnerable. Additionally, inspect build configurations for SSG page definitions using custom dir or filename values that may allow path traversal or symlink escapes.

Impact Analysis

This vulnerability could allow an attacker to create unauthorized files or directories outside the expected output directory with the permissions of the build user. This might lead to arbitrary code execution, data exfiltration, or system compromise if the build process processes untrusted content.

Compliance Impact

This vulnerability primarily involves path traversal in Quasar Framework's SSG build process, allowing unauthorized file creation outside the intended output directory. While it does not directly impact GDPR or HIPAA compliance, it could indirectly affect compliance by enabling unauthorized data access or modification if exploited in systems handling sensitive data. The vulnerability requires exploitation through compromised build configurations or untrusted page definitions, which may violate data integrity principles in regulated environments.

Mitigation Strategies

Upgrade Quasar Framework to version 3.3.0 or later to address the vulnerability in @quasar/app-vite SSG page definitions.

Hi! I’m here to help you understand CVE-2026-106108. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70