Path traversal in hono - CVE-2026-39408
Published: July 24, 2026
Vulnerability identifier: #VU139309
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-39408
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to write files outside the intended output directory.
The vulnerability exists due to path traversal in toSSG() when constructing output file paths from dynamic route parameters provided via ssgParams. A remote attacker can supply specially crafted parameter values containing traversal sequences to write files outside the intended output directory.
This issue is limited to build-time static site generation and does not affect request-time routing.
Affected software
hono
How to mitigate CVE-2026-39408
Install security update from vendor's website.
hono - update to 4.12.12