cve.bz

CVE-2026-104871

6.3 mediumEPSS 0.4%

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.

CVSS 4.0
6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-25)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-7g7c-h8rr-7p6qnpm@angular/ssr>=22.0.0 <22.1.722.1.7
GHSA-7g7c-h8rr-7p6qnpm@angular/ssr>=21.0.0 <21.2.2321.2.23
GHSA-7g7c-h8rr-7p6qnpm@angular/ssr>=20.0.0 <20.3.3620.3.36
GHSA-7g7c-h8rr-7p6qnpm@angular/ssr<=19.2.27no fix published

References

Check your stackJSON