CVE-2026-48049

Received Received - Intake

Path Traversal Vulnerability in @hapi/inert

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-48049

Affected Vendors & Products

Vendor	Product	Version / Range
@hapi	inert	7.1.1
@hapi	inert	From 4.0.0 (inc) to 7.1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects @hapi/inert versions 4.0.0 to 7.1.0. It allows unauthenticated remote attackers to read files outside the intended directory by using a path traversal technique with encoded slashes like /..%2f. The confinement check fails to properly restrict access to sibling directories.

Detection Guidance

Check if your system uses @hapi/inert versions between 4.0.0 and 7.1.0. Inspect installed packages with commands like 'npm list @hapi/inert' or 'yarn list @hapi/inert'. Test for path traversal by accessing URLs like '/..%2fstatic-secret/secret.txt' on your server to see if unauthorized files are exposed.

Impact Analysis

An attacker could exploit this to read sensitive files on the server, such as configuration files, secrets, or other restricted data. This could lead to information disclosure or further attacks if those files contain credentials or other sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations and potential fines.

Mitigation Strategies

Upgrade @hapi/inert to version 7.1.1 or later immediately. If upgrading is not possible, disable static file serving or restrict access to sensitive directories. Review server logs for suspicious access attempts using path traversal patterns.

Hi! I’m here to help you understand CVE-2026-48049. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70