{"id":"CVE-2026-104871","summary":"Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows","details":"The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.","aliases":["GHSA-7g7c-h8rr-7p6q"],"modified":"2026-10-04T02:46:04.750420609Z","published":"2026-10-02T19:43:50.475Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104871.json"},"references":[{"type":"WEB","url":"https://github.com/angular/angular-cli/releases/tag/v20.3.36"},{"type":"WEB","url":"https://github.com/angular/angular-cli/releases/tag/v21.2.23"},{"type":"WEB","url":"https://github.com/angular/angular-cli/releases/tag/v22.1.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104871.json"},{"type":"ADVISORY","url":"https://github.com/angular/angular-cli/security/advisories/GHSA-7g7c-h8rr-7p6q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104871"},{"type":"FIX","url":"https://github.com/angular/angular-cli/commit/645e41a47d21b7651837a4250de99af0509626e2"},{"type":"FIX","url":"https://github.com/angular/angular-cli/commit/70748ca8e76fe4b42798719410336119d943e755"},{"type":"FIX","url":"https://github.com/angular/angular-cli/commit/bb72145f9ab45aee29f523236b3a25cd0813a841"},{"type":"FIX","url":"https://github.com/angular/angular-cli/commit/c3e5982e49705f0f6a913cb94622b4c555d2d914"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/angular/angular-cli","events":[{"introduced":"0"},{"introduced":"a06ccb3f5f20364bfd0ff47269ac63824652d118"},{"introduced":"9b15fa6d7c257cdf13ccc7e3bdb5723ff334dd6a"},{"fixed":"a9f4dae68fb02e936b2bcae5f2e190296935194c"},{"fixed":"e2582bb34e94457007c4c60b46436abd883d0630"},{"fixed":"7e133c422a0776a4cf68d9636d9b778a845b9f06"},{"fixed":"645e41a47d21b7651837a4250de99af0509626e2"},{"fixed":"70748ca8e76fe4b42798719410336119d943e755"},{"fixed":"bb72145f9ab45aee29f523236b3a25cd0813a841"},{"fixed":"c3e5982e49705f0f6a913cb94622b4c555d2d914"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"20.3.36"},{"introduced":"21.0.0"},{"fixed":"21.2.23"},{"introduced":"22.0.0"},{"fixed":"22.1.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v21.2.22","v20.3.35","v22.1.6","v22.2.0-next.5","v20.3.34","v21.2.21","v22.1.5","v22.2.0-next.4","v22.1.4","v22.2.0-next.3","v21.2.20","v20.3.33","v22.1.3","v22.2.0-next.2","v22.2.0-next.1","v20.3.32","v21.2.19","v22.1.2","v22.1.1","v22.2.0-next.0","v22.1.0","v22.1.0-rc.0","v22.1.0-next.4","v21.2.18","v20.3.31","v22.1.0-next.3","v22.1.0-next.2","v21.2.17","v20.3.30","v22.1.0-next.1","v20.3.29","v21.2.16","v22.1.0-next.0","v21.2.15","v20.3.28","v20.3.27","v21.2.14","v20.3.26","v21.2.13","v21.2.12","v21.2.11","v20.3.25","v22.0.0-next.8","v21.2.10","v21.2.9","v22.0.0-next.7","v20.3.24","v21.2.8","v22.0.0-next.6","v20.3.23","v21.2.7","v22.0.0-next.5","v20.3.22","v22.0.0-next.4","v21.2.6","v21.2.5","v20.3.21","v21.2.4","v22.0.0-next.3","v21.2.3","v22.0.0-next.2","v20.3.20","v22.0.0-next.1","v21.2.2","v20.3.19","v22.0.0-next.0","v21.2.1","v20.3.18","v20.3.17","v21.2.0","v21.2.0-rc.2","v21.2.0-rc.1","v20.3.16","v21.2.0-rc.0","v21.2.0-next.2","v21.2.0-next.1","v20.3.15","v21.2.0-next.0","v20.3.14","20.3.13","v21.1.0-next.3","v21.1.0-next.2","21.1.0-next.1","20.3.12","21.1.0-next.0","20.3.11","20.3.10","20.3.9","20.3.8","20.3.7","20.3.6","21.0.0-next.8","20.3.5","21.0.0-next.7","20.3.4","21.0.0-next.6","20.3.3","21.0.0-next.5","20.3.2","21.0.0-next.4","20.3.1","20.3.0","21.0.0-next.3","20.3.0-rc.0","20.2.2","21.0.0-next.2","20.2.1","21.0.0-next.1","20.2.0","21.0.0-next.0","20.2.0-rc.1","20.2.0-rc.0","20.2.0-next.3","20.2.0-next.2","20.2.0-next.1","20.2.0-next.0","20.1.0-next.3","20.1.0-next.2","20.1.0-next.1","20.1.0-next.0","20.0.0-next.8","20.0.0-next.7","20.0.0-next.6","20.0.0-next.5","20.0.0-next.4","20.0.0-next.3","20.0.0-next.2","20.0.0-next.1","20.0.0-next.0","19.2.0-next.2","19.2.0-next.1","19.2.0-next.0","19.1.0-next.2","19.1.0-next.1","19.1.0-next.0","19.0.0-next.12","19.0.0-next.11","19.0.0-next.10","19.0.0-next.9","19.0.0-next.8","19.0.0-next.7","19.0.0-next.6","19.0.0-next.5","19.0.0-next.4","19.0.0-next.3","19.0.0-next.2","19.0.0-next.1","19.0.0-next.0","18.2.0-next.3","18.2.0-next.2","18.2.0-next.1","18.2.0-next.0","18.1.0-next.3","18.1.0-next.2","18.1.0-next.1","18.1.0-next.0","18.0.0-next.4","18.0.0-next.3","18.0.0-next.2","18.0.0-next.1","18.0.0-next.0","17.2.0-next.1","17.2.0-next.0","17.1.0-next.3","17.1.0-next.2","17.1.0-next.1","17.1.0-next.0","17.0.0-next.9","17.0.0-next.8","17.0.0-next.7","17.0.0-next.6","17.0.0-next.5","17.0.0-next.3","17.0.0-next.2","17.0.0-next.1","17.0.0-next.0","16.2.0-next.4","16.2.0-next.3","16.2.0-next.2","16.2.0-next.1","16.2.0-next.0","16.1.0-next.2","16.1.0-next.1","16.1.0-next.0","16.0.0-next.6","16.0.0-next.5","16.0.0-next.4","16.0.0-next.3","16.0.0-next.2","16.0.0-next.1","16.0.0-next.0","15.2.0-next.4","15.2.0-next.3","15.2.0-next.2","15.2.0-next.1","15.2.0-next.0","15.1.0-next.3","15.1.0-next.2","15.1.0-next.1","15.1.0-next.0","15.0.0-next.4","15.0.0-next.3","15.0.0-next.2","15.0.0-next.1","15.0.0-next.0","14.2.0-next.2","14.2.0-next.1","14.2.0-next.0","14.1.0-next.4","14.1.0-next.3","14.1.0-next.2","14.1.0-next.1","14.1.0-next.0","14.0.0-next.12","14.0.0-next.11","14.0.0-next.10","14.0.0-next.9","14.0.0-next.8","14.0.0-next.7","14.0.0-next.6","14.0.0-next.5","14.0.0-next.4","14.0.0-next.3","14.0.0-next.2","14.0.0-next.1","14.0.0-next.0","13.2.0-next.2","13.2.0-next.1","13.2.0-next.0","13.1.0-next.3","13.1.0-next.2","13.1.0-next.1","13.1.0-next.0","13.0.0-next.8","13.0.0-next.7","13.0.0-next.6","13.0.0-next.5","13.0.0-next.4","13.0.0-next.3","13.0.0-next.2","13.0.0-next.1","13.0.0-next.0","12.2.0-next.3","v12.2.0-next.2","v12.2.0-next.1","v12.1.0","v12.2.0-next.0","v12.1.0-next.6","v12.1.0-next.5","v12.1.0-next.4","v12.1.0-next.3","v12.1.0-next.2","v12.0.0-next.9","v12.0.0-next.8","v12.0.0-next.7","v12.0.0-next.6","v12.0.0-next.5","v12.0.0-next.4","v12.0.0-next.3","v12.0.0-next.2","v12.0.0-next.1","v12.0.0-next.0","v11.2.0-next.0","v11.1.0-next.4","v11.1.0-next.3","v11.1.0-next.2","v11.1.0-next.1","v11.1.0-next.0","v11.0.0-next.7","v11.0.0-next.6","v11.0.0-next.5","v11.0.0-next.4","v11.0.0-next.3","v11.0.0-next.2","v11.0.0-next.1","v11.0.0-next.0","v10.1.0-next.7","v10.1.0-next.6","v10.1.0-next.5","v10.1.0-next.4","v10.1.0-next.3","v10.1.0-next.2","v10.1.0-next.1","v10.1.0-next.0","v10.0.0-rc.0","v10.0.0-next.6","v10.0.0-next.5","v10.0.0-next.4","v10.0.0-next.3","v10.0.0-next.2","v10.0.0-next.1","v10.0.0-next.0","v9.1.0-next.4","v9.1.0-next.3","v9.1.0-next.2","v9.1.0-next.1","v9.1.0-next.0","v9.0.0-next.19","v9.0.0-next.18","v9.0.0-next.17","v9.0.0-next.16","v9.0.0-next.15","v9.0.0-next.14","v9.0.0-next.13","v9.0.0-next.12","v9.0.0-next.11","v9.0.0-next.10","v9.0.0-next.9","v9.0.0-next.8","v9.0.0-next.7","9.0.0-next.7","v9.0.0-next.6","v9.0.0-next.5","v9.0.0-next.4","v9.0.0-next.3","v9.0.0-next.2","v9.0.0-next.1","v9.0.0-next.0","v8.3.0-rc.0","v8.3.0-next.2","v8.3.0-next.1","v8.3.0-next.0","v8.2.0-rc.0","v8.2.0-next.2","v8.2.0-next.1","v8.2.0-next.0","v8.1.0","v8.1.0-rc.0","v8.1.0-beta.3","v8.1.0-beta.2","v8.1.0-beta.1","v8.1.0-beta.0","v8.0.0-beta.18","v8.0.0-beta.17","v8.0.0-beta.16","v8.0.0-beta.15","v8.0.0-beta.14","v8.0.0-beta.13","v8.0.0-beta.12","v8.0.0-beta.11","v8.0.0-beta.10","v8.0.0-beta.9","v8.0.0-beta.8","v8.0.0-beta.7","v8.0.0-beta.6","v8.0.0-beta.5","v8.0.0-beta.4","v8.0.0-beta.3","v8.0.0-beta.2","v8.0.0-beta.1","v8.0.0-beta.0","v7.3.0-rc.0","v7.3.0-beta.0","v7.2.0-rc.0","v7.2.0-beta.2","v7.2.0-beta.1","v7.2.0-beta.0","v7.1.0-rc.0","v7.1.0-beta.1","v7.1.0-beta.0","v7.0.0-rc.3","v7.0.0-rc.2","v7.0.0-rc.0","v7.0.0-beta.4","v7.0.0-beta.3","v7.0.0-beta.2","v6.2.0-rc.0","v6.2.0-beta.3","v6.2.0-beta.2","v6.2.0-beta.1","v6.2.0-beta.0","v6.0.0","v6.0.0-rc.10","v6.0.0-rc.9","v6.0.0-rc.7","v6.0.0-rc.6","v6.0.0-rc.5","v6.0.0-rc.4","v6.0.0-rc.3","v6.0.0-rc.2","v6.0.0-rc.1","v6.0.0-rc.0","v6.0.0-beta.9","v6.0.0-beta.8","v6.0.0-beta.7","v6.0.0-beta.6","v6.0.0-beta.5","v6.0.0-beta.3","v1.5.0-beta.0","v1.4.0-beta.1","v1.0.1","v1.0.0","v1.0.0-rc.4","v1.0.0-rc.2","v1.0.0-rc.1","v1.0.0-rc.0","v1.0.0-beta.32","v1.0.0-beta.31","v1.0.0-beta.30","v1.0.0-beta.28","v1.0.0-beta.26","v1.0.0-beta.23","v1.0.0-beta.22-1","v1.0.0-beta.22","v1.0.0-beta.21","v1.0.0-beta.20-1","v1.0.0-beta.19","v1.0.0-beta.18","v1.0.0-beta.17","v1.0.0-beta.15","v1.0.0-beta.14","v1.0.0-beta.11-webpack.2","v1.0.0-beta.10-webpack","v1.0.0-beta.10","1.0.0-beta.9","v1.0.0-beta.6","v1.0.0-beta.5","v1.0.0-beta.4","v1.0.0-beta.2-mobile.3","v1.0.0-beta.2-mobile","v1.0.0-beta.1","v1.0.0-beta.0","v0.1.0","v0.0.39","v0.0.37","v0.0.35","v0.0.34","v0.0.33","v0.0.31","v0.0.30","v0.0.29","v0.0.27","0.0.25","0.0.24","0.0.23","0.0.22","0.0.21","0.0.19","0.0.20","0.0.18","0.0.17","0.0.16","0.0.15","0.0.14","0.0.13"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104871.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}