Path Traversal in pathe 2.0.3

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: MITRE

Description

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-49030

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

The vulnerability in pathe through 2.0.3 involves unconditionally converting backslashes to forward slashes on all platforms, including POSIX systems where backslashes are valid filename characters. This causes functions like join(), resolve(), and normalize() to misinterpret backslash-separated dot sequences as directory traversal, deviating from Node.js path.posix behavior and enabling path traversal attacks that bypass input validation in server-side applications.

Impact Analysis

This vulnerability could allow attackers to bypass path validation checks in applications, leading to unauthorized file access or manipulation. Server-side applications relying on path normalization may be tricked into accessing sensitive files outside intended directories.

Mitigation Strategies

Update to a pathe version that aligns with Node.js path.posix behavior to prevent backslash normalization on POSIX systems. Avoid using pathe 2.0.3 or rely on its path traversal behavior.

Hi! I’m here to help you understand CVE-2026-49030. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70