Bug 2537856 (CVE-2026-93751)
| Summary: | CVE-2026-93751 uri-js: uri-js: Improper UTF-8 decoding allows path traversal and CRLF injection | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in uri-js. This improper UTF-8 (Unicode Transformation Format - 8-bit) decoding vulnerability in the `pctDecChars()` function allows a remote attacker to craft specially encoded payloads. These payloads can bypass platform decoder validation, leading to the injection of path traversal or Carriage Return Line Feed (CRLF) sequences. This could enable attackers to access unauthorized files or manipulate application logs and HTTP responses.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-09-22 15:47:41 UTC
|