moritzmyrz coursevault-preview up to 0.1.0 relativePath path traversal

Summaryinfo

A vulnerability, which was classified as critical, was found in moritzmyrz coursevault-preview up to 0.1.0. The impacted element is an unknown function. Such manipulation of the argument relativePath leads to path traversal. This vulnerability is listed as CVE-2026-35613. The attack must be carried out locally. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in moritzmyrz coursevault-preview up to 0.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument relativePath with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. CVE summarizes:

coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. This vulnerability is fixed in 0.1.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-35613 since 04/03/2026. The exploitation is known to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 0.1.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• moritzmyrz

Name

• coursevault-preview

Version

• 0.1.0

Website

• Product: https://github.com/moritzmyrz/coursevault-preview/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion