Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| angular | angular-cli | before 20.3.36; 21.0.0 to before 21.2.23; 22.0.0 to before 22.1.7 | 20.3.36, 21.2.23, 22.1.7 | Patch available | CNA |
| — | @angular/ssr (npm) | 22.0.0 to before 22.1.7 | 22.1.7 | Patch available | GHSA-7g7c-h8rr-7p6q |
| — | @angular/ssr (npm) | 21.0.0 to before 21.2.23 | 21.2.23 | Patch available | GHSA-7g7c-h8rr-7p6q |
| — | @angular/ssr (npm) | 20.0.0 to before 20.3.36 | 20.3.36 | Patch available | GHSA-7g7c-h8rr-7p6q |
| — | @angular/ssr (npm) | up to 19.2.27 | — | No fix listed | GHSA-7g7c-h8rr-7p6q |
- angular-cli Vendorangular Affected before 20.3.36; 21.0.0 to before 21.2.23; 22.0.0 to before 22.1.7 Fixed in 20.3.36, 21.2.23, 22.1.7 Patch available CNA
- @angular/ssr (npm) Vendor— Affected 22.0.0 to before 22.1.7 Fixed in 22.1.7 Patch available GHSA-7g7c-h8rr-7p6q
- @angular/ssr (npm) Vendor— Affected 21.0.0 to before 21.2.23 Fixed in 21.2.23 Patch available GHSA-7g7c-h8rr-7p6q
- @angular/ssr (npm) Vendor— Affected 20.0.0 to before 20.3.36 Fixed in 20.3.36 Patch available GHSA-7g7c-h8rr-7p6q
- @angular/ssr (npm) Vendor— Affected up to 19.2.27 Fixed in — No fix listed GHSA-7g7c-h8rr-7p6q
Remediation
- Fix · CNA angular-cli (angular) Fixed in 20.3.36, 21.2.23, 22.1.7
- Fix · GHSA-7g7c-h8rr-7p6q @angular/ssr (npm) Fixed in 22.1.7 Advisory →
- Fix · GHSA-7g7c-h8rr-7p6q @angular/ssr (npm) Fixed in 21.2.23 Advisory →
- Fix · GHSA-7g7c-h8rr-7p6q @angular/ssr (npm) Fixed in 20.3.36 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-104871
- 2026-10-06 Alias added: GHSA-7g7c-h8rr-7p6q
- 2026-10-06 Fix available: npm/@angular/[email protected], npm/@angular/[email protected], npm/@angular/[email protected] · GHSA-7g7c-h8rr-7p6q
- 2026-10-06 CVSS score added · GHSA-7g7c-h8rr-7p6q
- 2026-10-06 Weakness changed · GHSA-7g7c-h8rr-7p6q
- 2026-10-06 10 new references · GHSA-7g7c-h8rr-7p6q
References
Other 9
- https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q
- https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2
- https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755
- https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841
- https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914
- https://github.com/angular/angular-cli/releases/tag/v20.3.36
- https://github.com/angular/angular-cli/releases/tag/v21.2.23
- https://github.com/angular/angular-cli/releases/tag/v22.1.7
- https://github.com/angular/angular-cli
More angular vulnerabilities
- TI-2026-74069 Infinite loop in Angular SSR HTML parser allows denial of service CVSS 4.0HIGH 8.7
- TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
- TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
- TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
- TI-2025-38694 Server-Side Request Forgery (SSRF) in Angular SSR CVSS 4.0HIGH 8.7
- TI-2026-22098 Angular SSR has an Open Redirect via X-Forwarded-Prefix CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-104871 · CVE Program
- CVE-2026-104871 · NVD
- FIRST EPSS
- GHSA-7g7c-h8rr-7p6q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences