CVE-2026-106108
Description
A flaw was found in @quasar/app-vite. This path traversal vulnerability allows the creation of files and directories outside the intended build output directory. During the static site generation (SSG) build process, custom page definitions are combined with the destination path without proper destination validation. If a build process incorporates untrusted input into these page definitions, an attacker can exploit this issue to create new files across the file system with the permissions of the build user.
Statement
A moderate impact path traversal vulnerability was found in @quasar/app-vite, the Vite-based build tool of the Quasar Framework distributed as an npm package, affecting versions 3.1.0 through 3.2.0. During static site generation (SSG), page definitions returned by getSsgPages() could supply custom dir and filename values that were joined to the configured build output directory (build.distDir) without verifying that the final destination remained inside the distribution directory. An attacker able to influence an application's SSG page definitions, for example when a build process derives them from external or otherwise untrusted content, could use parent-directory traversal or an existing symlink below the distribution directory to create new files or directories outside the intended build output tree with the permissions of the build user. Quasar application configuration and SSG page definitions are trusted input by default, so this is not normally a remote file-write primitive, and existing files are protected by the SSG renderer's no-overwrite behavior; the impact is limited to integrity through the creation of new files at locations writable by the build user. Red Hat rates this flaw as moderate impact (CVSS 4.7), consistent with the moderate severity assigned by the upstream record. No Red Hat products are currently listed as affected by this flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. For applications built with the upstream @quasar/app-vite npm package, this issue is addressed by upgrading to a version that contains the upstream fix (3.3.0 or later).
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able to read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
