Path traversal in hono - #VU146049
Published: August 28, 2026
Vulnerability identifier: #VU146049
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to overwrite files outside the intended output directory.
The vulnerability exists due to path traversal in the toSSG() static site generation function when processing route parameter values supplied through ssgParams during static site generation. A remote attacker can supply crafted route parameter values containing consecutive parent-directory segments to overwrite files outside the intended output directory.
This issue affects build-time static site generation only, and applications whose ssgParams values are entirely developer-controlled are not affected. User interaction is required to generate the static site from untrusted route parameter values.
Affected software
hono
Remediation
Install security update from vendor's website.
hono - update to 4.13.5