CVE-2026-106108: fallo de gravedad media en quasarframework quasar
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.7epss 0.1%
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions. Application configuration and SSG page definitions are trusted by default, so exploitation requires a build process that derives them from external or otherwise less-trusted content; existing files remain protected by the renderer's no-overwrite behavior. This issue is fixed in version 3.3.0.
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
CVEs relacionadas — quasarframework quasar
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-73647MEDIUMQuasar Framework: Prototype pollution in Quasar extend() utilityEPSS 0.4%CVE-2026-106104HIGHQuasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR serverEPSS 0.4%CVE-2026-106102CRITICALQuasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()EPSS 0.3%CVE-2026-106103HIGHQuasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profileEPSS 0.3%CVE-2026-106106HIGHQuasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassableEPSS 0.3%CVE-2026-106107HIGHQuasar Framework: App Vite SSR and SSG nonce attributes are not safely constrainedEPSS 0.3%