Bug 2517456 (CVE-2026-73646)

Summary:	CVE-2026-73646 postcss: PostCSS: Information disclosure via path traversal in source map auto-loading
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abarbaro, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, anthomas, anujha, aoconnor, aos-team-art-private, aruklets, aschwart, asdas, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, bniver, boliveir, bparees, brasmith, bstansbe, cdrage, cmyers, cochase, dbruscin, dlofthou, dmayorov, dnakabaa, doconnor, dpaolell, dranck, drichtar, dschmidt, dymurray, eborisov, ehelms, ehugonne, ewittman, flucifre, fmariani, ggainey, gmalinko, gmeno, gparvin, groman, hasun, ibolton, istudens, ivassile, iweiss, janstey, jchui, jdelft, jfula, jhe, jlanda, jlledo, jmatthew, jmontleo, jowilson, jpasqual, jprabhak, jupierce, juwatts, jwong, jwon, kaycoth, kshier, ktsao, kvanderr, lball, lchilton, lcouzens, lgarciaa, mbenjamin, mbiarnes, mcarlett, mdellweg, mhackett, mhulan, mosmerov, mposolda, msvehla, nboldt, ngough, nipatil, nmoumoul, nwallace, nyancey, oaljalju, omaciel, ometelka, osousa, pantinor, pberan, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, ppalepu, ppostler, prdhamdh, prwatson, psrna, ptisnovs, rchan, rhaigner, rhel-process-autobot, rjohnson, rkubis, rmartinc, rstancel, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, sostapov, sseago, ssilvert, stcannon, sthorger, suppawar, syedriko, tcunning, teagle, thjenkin, tmalecek, tsedmik, ttakamiy, vdosoudi, vereddy, veshanka, vlaad, vmuzikar, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted `sourceMappingURL` values in untrusted CSS files. This allows the attacker to disclose sensitive `sourcesContent` from arbitrary `.map` files accessible on the system, leading to information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-17 15:47:09 UTC

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.