CVE-2026-48049 Details
Description
@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.
A path traversal vulnerability has been identified in the @hapi/inert package, versions 4.0.0 through 7.1.0. This vulnerability allows an unauthenticated remote attacker to read files from a sibling directory that shares a prefix with the confined directory being served. The issue arises because the confinement check improperly uses a raw string-prefix comparison, enabling exploitation by crafting a request that traverses out of the confined directory.
Users are advised to upgrade to @hapi/inert version 7.1.1. For those unable to upgrade immediately, ensure that the served directory has no sibling directories with names that could be exploited.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9 | [email protected] | Source CodeVendor |
| https://github.com/hapijs/inert/pull/176 | [email protected] | Issue TrackingVendor |
| https://github.com/hapijs/inert/releases/tag/v7.1.1 | [email protected] | Release NotesVendor |
| https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @hapi/inert | >= 4.0.0, <= 7.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |