CVE-2026-7120

MediumCVSS 5.3/10Last modified Jul 28, 2026

Description

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-180

Affected software

No affected versions have been published.

Timeline

Published: Jul 23, 2026
Last modified: Jul 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-712015.0In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or CVE-2026-712027.5The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/of CVE-2026-712035.3changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the CVE-2026-712046.2changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored applicat CVE-2026-712056.5changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate CVE-2026-712068.3Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account obje CVE-2026-712079.8The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by CVE-2026-712086.5KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resourc CVE-2026-712097.5audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a r CVE-2026-71219.8A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of th CVE-2026-712105.3Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against p CVE-2026-712117.1MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret)