CVE-2026-104871 in CLI
Summary
by MITRE • 10/02/2026
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in the Angular Server-Side Rendering (SSR) module represents a path traversal flaw specific to Windows-based deployments using certain legacy versions of the framework. The core issue resides within the CommonEngine retrieveSSGPage logic, which is responsible for retrieving prerendered pages during static site generation operations. In affected versions prior to 20.3.36, 21.2.23, and 22.1.7, as well as in version ranges 17 through 18 of the @angular/ssr package, the system fails to properly sanitize relative request URLs that contain backslash parent-traversal segments when executed on Windows operating systems. This behavior stems from a combination of URL resolution quirks and path normalization inconsistencies where the non-special resolve:// URL base preserves the backslash character, which is then interpreted by Node.js's path.join function as a directory separator rather than a literal character or invalid syntax.
The technical mechanism of this flaw allows an unauthenticated attacker to bypass intended access controls through sibling directory traversal. The vulnerability exploits a logic error in the validation check that verifies whether the resolved pagePath starts with the configured publicDirectory prefix. Because the path normalization process incorrectly handles the backslash on Windows, it can result in a resolved path that points to a sibling output directory rather than the intended target within the current directory structure. If this sibling directory shares a name prefix with the configured public-directory and contains prerendered Angular HTML files marked with the SSG indicator, the system will erroneously accept the request and serve the content from the unauthorized location. This effectively allows an attacker to read sensitive static assets or internal page structures that were not intended for external access by simply manipulating the URL path with backslash sequences.
From a security classification perspective, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as directory traversal. The attack vector is categorized under ATT&CK technique T1083: File and Directory Discovery, specifically leveraging the ability to enumerate or access files outside the restricted web root through path manipulation. It is critical to note that this vulnerability does not constitute an arbitrary file read vulnerability in the general sense because it is strictly limited to retrieving prerendered HTML pages within sibling directories that share specific naming prefixes with the public directory. The impact is therefore confined to information disclosure of static content rather than access to server-side configuration files, source code, or sensitive data stored outside the web-accessible hierarchy.
The operational impact is primarily restricted to environments running on Windows where relative request URLs are passed directly to CommonEngine.render without adequate sanitization. Deployments that utilize a prefix-sharing sibling output directory structure and serve prerendered Angular content are at risk. The vulnerability does not affect Linux or macOS deployments due to the different handling of path separators, nor does it impact applications that do not use static site generation features with relative URL routing in this specific manner. Consequently, while the severity is moderate due to its limited scope, it poses a significant risk for organizations deploying Angular SSR on Windows servers without proper input validation and path normalization safeguards.
To mitigate this vulnerability, administrators must upgrade the @angular/ssr package to version 20.3.36 or later, specifically targeting versions 21.2.23 and 22.1.7 as recommended by the Angular team. For organizations unable to immediately upgrade, implementing strict input validation on all relative request URLs is essential. This includes rejecting any URL paths containing backslash characters when running on Windows environments, ensuring that only forward slashes are used for path navigation in HTTP requests regardless of the underlying operating system's native separator. Additionally, developers should review their directory structures to avoid using shared prefixes between public directories and sibling output folders, thereby reducing the attack surface even if other mitigations are partially effective. Regular security audits focusing on SSR implementations and static site generation configurations will help identify similar path handling issues in custom rendering logic or third-party integrations within Angular applications.