CVE-2026-92812 Details

A path traversal vulnerability has been identified in the Decap Server local proxy, specifically in the version corresponding to commit 11f35405cd1a1d1216e97b890173f46436752019. The vulnerability arises from the proxy's path containment validation, which improperly uses plain string prefix comparisons without adequate path separator checks. This flaw enables attackers to access sibling directories whose names start with the repository directory name, potentially leading to unauthorized reading, writing, or deletion of files outside the designated repository root. The issue can be exploited by manipulating file paths sent to the proxy API, such as through a misconfigured CMS collection or a stored cross-site scripting vector in the admin UI.

The vulnerability can be fixed by modifying the path validation to include a trailing path separator before performing the prefix comparison, ensuring that only paths truly within the repository are accepted.