CVE-2026-67200

CVE-2026-67200 is a path traversal vulnerability in an asset-serving endpoint that exposes credentials and application secrets. The most telling detail is that developers sanitized query strings while leaving URL path segments entirely unchecked — they were defending against query parameter injection, not path traversal. This mismatch between the implemented control and the actual attack surface is the vulnerability's fingerprint: someone applied a security function from a different context (likely an API endpoint where query parameters were the threat) without re-evaluating whether it applied to this asset server. The "asset root" configuration lulls developers into a false sense of containment. Most implementations perform simple string prefix removal, not semantic sandboxing — `/assets/foo/../../../etc/passwd` often passes because only the final concatenated path is checked, not the URL segments themselves. If you use a framework with built-in static file middleware, verify it hasn't been disabled or bypassed in this code path; explicit application-layer handling may have replicated only a fraction of the framework's validation. The wildcard Access-Control-Allow-Origin header compounds this dramatically. A path traversal allowing arbitrary file read is serious; the same vulnerability with permissive CORS is a client-side exploit. You don't need shell access to the server — a browser visiting a malicious page can pull credentials out of the exposed config files via JavaScript. This converts a server-side vulnerability into a cross-origin exfiltration path, dramatically widening your attack surface. For assessment: trace where your asset root gets enforced and confirm it validates URL path segments, not just query parameters. Review whether input validation code was copied from other endpoints and never adapted. Check CORS policies on any endpoint that serves files — wildcard is appropriate only when the data being served has no sensitivity. The combination of unvalidated path traversal plus permissive CORS on an endpoint serving potentially sensitive configuration is a composition failure that neither control modeled in isolation.

Reviewed through automated stages and approved by a human before publication.