CVE-2026-106108: medium-severity vulnerability in quasarframework quasar
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.7epss 0.1%
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions. Application configuration and SSG page definitions are trusted by default, so exploitation requires a build process that derives them from external or otherwise less-trusted content; existing files remain protected by the renderer's no-overwrite behavior. This issue is fixed in version 3.3.0.
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Related CVEs — quasarframework quasar
In the same product, most dangerous first.
CVE-2026-73647MEDIUMQuasar Framework: Prototype pollution in Quasar extend() utilityEPSS 0.4%CVE-2026-106104HIGHQuasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR serverEPSS 0.4%CVE-2026-106102CRITICALQuasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()EPSS 0.3%CVE-2026-106103HIGHQuasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profileEPSS 0.3%CVE-2026-106106HIGHQuasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassableEPSS 0.3%CVE-2026-106107HIGHQuasar Framework: App Vite SSR and SSG nonce attributes are not safely constrainedEPSS 0.3%