logto-tunnel serves files outside --experience-path via path traversal
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through packages/tunnel/src/commands/tunnel/utils.ts using path.join(staticPath, request.url) and then fs.open(requestPath, "r") without URL normalization or a containment check. When --experience-path was enabled and the tunnel port was reachable, an unauthenticated requester could send a path containing ../ to createStaticFileProxy and read files outside the configured static directory that were readable by the logto-tunnel process. The service used server.listen(port), which could expose the tunnel to other hosts depending on the platform and deployment. This issue is fixed in version 0.3.9.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| logto-io | logto | before 0.3.9 | 0.3.9 | Patch available | CNA |
| — | @logto/tunnel (npm) | before 0.3.9 | 0.3.9 | Patch available | GHSA-rxjr-6c9q-h67x |
- logto Vendorlogto-io Affected before 0.3.9 Fixed in 0.3.9 Patch available CNA
- @logto/tunnel (npm) Vendor— Affected before 0.3.9 Fixed in 0.3.9 Patch available GHSA-rxjr-6c9q-h67x
Remediation
- Fix · CNA logto (logto-io) Fixed in 0.3.9
- Fix · GHSA-rxjr-6c9q-h67x @logto/tunnel (npm) Fixed in 0.3.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63188
- 2026-10-03 Alias added: GHSA-rxjr-6c9q-h67x
- 2026-11-05 1 new reference · GHSA-rxjr-6c9q-h67x
References
Other 5
- https://github.com/logto-io/logto/security/advisories/GHSA-rxjr-6c9q-h67x
- https://github.com/logto-io/logto/pull/9113
- https://github.com/logto-io/logto/commit/5686815955534f803d3d50738259efd0f741e62c
- https://github.com/logto-io/logto/releases/tag/@logto/[email protected]
- https://github.com/logto-io/logto
More logto-io vulnerabilities
- TI-2026-44494 Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing) CVSS 3.1HIGH 7.5
- TI-2026-40275 XML injection in logto-io logto CVSS 3.1HIGH 8.5
- TI-2026-56728 Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL CVSS 4.0HIGH 8.2
- TI-2026-39955 Logto: Account Center MFA management step-up bypass via WebAuthn registration verification CVSS 3.1HIGH 8.1
- TI-2026-45089 Logto: Account API can disclose stored third-party provider tokens without the identities scope CVSS 3.1HIGH 7.6
- TI-2026-45086 Logto: OS command injection vulnerability exists in the Commitlint workflow CVSS 3.1MEDIUM 6.3
Sources
- CVE-2026-63188 · CVE Program
- CVE-2026-63188 · NVD
- FIRST EPSS
- GHSA-rxjr-6c9q-h67x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences