CVE-2026-49144

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jun 2, 2026
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-491457.5App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchCVE-2026-491467.5App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the diCVE-2026-491477.5App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prinCVE-2026-49156.5Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhCVE-2026-491578.8Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.CVE-2026-491587.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache ThCVE-2026-491596.5Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a nCVE-2026-49162.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 CVE-2026-491607.5Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network.CVE-2026-491617.8Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally.CVE-2026-491627.0Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-491638.8Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacke