CVE-2026-72571

CVE-2026-72571 is a path traversal vulnerability in Express.js's res.sendFile() function, and the technical details mask a deeper systemic failure that defenders need to understand. The vulnerability arises when developers pass unsanitized user input directly to sendFile—writing res.sendFile(req.body.dir) feels like reasonable media-serving code, but sendFile performs arbitrary filesystem access, not the constrained file serving its name implies. The key insight for defenders: this isn't primarily a developer error. It's a framework ergonomics failure. Express's sendFile API provides no friction, no warnings, and no distinction between 'serve a file the server controls' and 'serve any file an attacker requests.' When a developer writes what feels like legitimate code, the framework gives them no reason to question it. The CVSS captures impact but not causation. The vulnerability in cast-localvideo isn't exotic—the developer likely intended legitimate media serving. But Express actually ships mitigations that most developers never encounter: the `root` parameter constrains file access to a directory, and `pathValidation` enables explicit path checking. The failure isn't that these don't exist—it's that they're buried in the options object, not surfaced as first-class security features, and they're opt-in rather than defaults. What you should do now: audit any code passing user input to res.sendFile() or res.download(). Add explicit `root` parameters to constrain file serving to intended directories. Validate and normalize paths with path.resolve() before passing them to sendFile. Consider that Express serves files with the process's filesystem permissions—an attacker who exploits path traversal can read any file the Node process can access, which in typical deployments includes far more than the HTTP interface should ever reach. The broader pattern matters: Express has 26+ million weekly downloads, sendFile is idiomatic Express, and vulnerable usage patterns cascade through middleware ecosystems. A single CVE in a popular library propagates to thousands of downstream apps. The remediation graph has no central node—you can't force upstream to update, and many vulnerable deployments will persist for months or years. This isn't a patch-and-move-on CVE; it's a class of vulnerability that requires framework-level changes to prevent recurrence.

Reviewed through automated stages and approved by a human before publication.