5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48049

CVE-2026-48049: @hapi/inert: Static-file confinement bypass via sibling-prefix path

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48049

CVE-2026-48049:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@hapi/inert	npm	>= 4.0.0, <= 7.1.0	7.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the @hapi/inert package, which is used for serving static files in Hapi.js applications. The core of the issue lies in the response function within lib/file.js. This function is responsible for handling file requests and ensuring that file access is restricted to a specified directory (a feature known as "confinement").

The vulnerability arises from an incorrect implementation of this confinement check. The original code checked if the resolved file path started with the configured directory's path. However, this check was a simple string prefix comparison. This meant that if a sibling directory existed with a name that started with the same characters as the intended directory (e.g., a served directory /var/www/static and a sibling /var/www/static-secret), an attacker could use path traversal techniques (../) to access files within that sibling directory.

The patch corrects this flaw by making the path validation more stringent. Instead of just checking for a matching prefix, the updated code in the response function now verifies that the requested path is either the confined directory itself or is located inside it by checking for the presence of a path separator (/ or \) immediately following the directory name in the path. This ensures that sibling directories are no longer accessible, effectively mitigating the path traversal vulnerability. Any runtime profile of a vulnerable application would show the response function being called during the exploitation of this vulnerability.

Vulnerable functions

response

lib/file.js

The `response` function in `lib/file.js` is responsible for serving static files. The vulnerability is in the logic that confines file access to a specific directory. The original code used a weak prefix check (`path.lastIndexOf(confineDir, 0) !== 0`) to validate the file path. This could be bypassed by requesting a path to a sibling directory that shares a common prefix with the intended directory, allowing an attacker to read arbitrary files. The patch introduces a stricter check that verifies the path is either the directory itself or is followed by a path separator, preventing access to sibling directories.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.