5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39408

CVE-2026-39408: Hono has a path traversal in toSSG() allows writing files outside the output directory

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39408

CVE-2026-39408:

5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	>= 4.0.0, <= 4.12.11	4.12.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue within the static site generation (SSG) functionality of Hono, specifically in the toSSG function. The root cause lies in the generateFilePath function (src/helper/ssg/ssg.ts), which was responsible for constructing file paths for the generated static assets. Before the patch, this function did not properly sanitize or validate the routePath parameter, which can be controlled by user input through the ssgParams middleware. An attacker could supply path traversal sequences (e.g., ../) in the parameters for a dynamic route. The generateFilePath function would then concatenate the base output directory with the malicious route path, resulting in a final path that resolves to a location outside of the intended output directory. This would allow an attacker to write arbitrary files to unintended locations on the filesystem during the build process. The patch addresses this by introducing a new validation function, ensureWithinOutDir (src/helper/ssg/utils.ts), which checks if the generated path is confined within the specified output directory. The generateFilePath function is modified to use this new validation function before returning the path, thus mitigating the vulnerability. The toSSG function is the main entry point for this entire process and is what a developer would interact with, making it a critical part of the vulnerable workflow.

Vulnerable functions

generateFilePath

src/helper/ssg/ssg.ts

The `generateFilePath` function is responsible for constructing the final file path for static site generation. Prior to the patch, it directly concatenated the output directory with a `routePath` that could be controlled by user input via `ssgParams`. It lacked validation to prevent path traversal sequences (e.g., `../`), allowing a crafted `routePath` to point to a location outside the intended output directory. The patch remediates this by adding a call to `ensureWithinOutDir` to validate the path.

toSSG

src/helper/ssg/ssg.ts

`toSSG` is the main public API for Hono's static site generation feature. It initiates the process that consumes user-provided `ssgParams`. When these parameters contain a path traversal payload, `toSSG` orchestrates the sequence of calls that leads to the vulnerable `generateFilePath` function being invoked with malicious input, resulting in a file being written outside the designated output directory. Therefore, `toSSG` is a key function that would appear in a profiler trace during exploitation.

ensureWithinOutDir

src/helper/ssg/utils.ts

This function was added as part of the fix to prevent path traversal. It is a security control function that validates whether a generated file path is within the intended output directory. Its presence in the patch is direct evidence of the path traversal vulnerability being addressed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.