CVE-2026-35613

Vulnerability

The resolveSafe utility in coursevault-preview versions prior to 0.1.1 uses String.prototype.startsWith(baseDir) to validate that a resolved path stays within the configured base directory [1][3]. This check does not enforce a directory boundary, so a path like /srv/courses-admin/config.json passes the guard when baseDir is /srv/courses because the string prefix matches [3].

Exploitation

An attacker who controls the relativePath argument passed to methods such as readFile, previewFile, or getFileMetadata can craft a path that traverses into a sibling directory whose name shares a string prefix with the base directory [1][3]. For example, if baseDir is /srv/courses, a relativePath of ../courses-admin/config.json resolves to /srv/courses-admin/config.json, which incorrectly passes the startsWith check [3]. No network exposure exists in the package itself; the attack is limited to local file disclosure within the host process's file system permissions [3].

Impact

Successful exploitation allows reading arbitrary files from sibling directories that share a prefix with the base directory, potentially exposing sensitive configuration files, credentials, or other data [1][3]. The vulnerability is rated Medium (CVSS 5.1) [1].

Mitigation

The vulnerability is fixed in version 0.1.1 [1][3]. The fix replaces the string prefix check with a separator-aware comparison that ensures the resolved path either equals the base directory or begins with the base directory followed by a path separator [3]. Users should update to the latest version immediately [3.