Vulnerability Description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through packages/tunnel/src/commands/tunnel/utils.ts using path.join(staticPath, request.url) and then fs.open(requestPath, "r") without URL normalization or a containment check. When --experience-path was enabled and the tunnel port was reachable, an unauthenticated requester could send a path containing ../ to createStaticFileProxy and read files outside the configured static directory that were readable by the logto-tunnel process. The service used server.listen(port), which could expose the tunnel to other hosts depending on the platform and deployment. This issue is fixed in version 0.3.9.
Related Weaknesses (CWE)
References
- https://github.com/logto-io/logto/commit/5686815955534f803d3d50738259efd0f741e62
- https://github.com/logto-io/logto/pull/9113
- https://github.com/logto-io/logto/releases/tag/@logto/[email protected]
- https://github.com/logto-io/logto/security/advisories/GHSA-rxjr-6c9q-h67x
FAQ
What is CVE-2026-63188?
CVE-2026-63188 is a documented vulnerability. Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts ...
How severe is CVE-2026-63188?
CVSS scoring is not yet available for CVE-2026-63188. Check NVD for updates.
Is there a patch for CVE-2026-63188?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.