TI-2026-27714 Aliases CVE-2026-35613 GHSA-9h9m-rr67-9jpg

Path traversal in coursevault-preview due to improper base-directory boundary validation

LOW 22CWE-22Published 2026-04-07 · Updated 2026-04-09

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. This vulnerability is fixed in 0.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00146 3rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed coursevault-preview (moritzmyrz): 0.1.1coursevault-preview (npm): 0.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
moritzmyrz	coursevault-preview	before 0.1.1	0.1.1	Patch available	CNA
—	coursevault-preview (npm)	before 0.1.1	0.1.1	Patch available	GHSA-9h9m-rr67-9jpg

coursevault-preview Vendormoritzmyrz Affected before 0.1.1 Fixed in 0.1.1 Patch available CNA
coursevault-preview (npm) Vendor— Affected before 0.1.1 Fixed in 0.1.1 Patch available GHSA-9h9m-rr67-9jpg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:moritzmyrz:coursevault-preview::::::node.js::*	before 0.1.1	Vulnerable	moritzmyrz

cpe:2.3:a:moritzmyrz:coursevault-preview:*:*:*:*:*:node.js:*:* Versions before 0.1.1 Vulnerable ·moritzmyrz

Remediation

Fix · CNA coursevault-preview (moritzmyrz) Fixed in 0.1.1
Fix · GHSA-9h9m-rr67-9jpg coursevault-preview (npm) Fixed in 0.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-35613
2026-10-03 Alias added: GHSA-9h9m-rr67-9jpg

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences