CVE-2026-116073: Typescript Url Pathname Decode After Basename Path Traversalcve-2026-116073-typescript-url-pathname-decode-after-basename-path-traversal
A URL path is passed to path.basename() BEFORE decodeURIComponent(), so percent-encoded separators (%2f, %5c) and dot segments (%2e%2e) survive basename() and only decode into '/', '\' or '../' afterwards. The decoded file name can therefore contain traversal segments, and joining it onto a base directory with path.join() resolves the destination outside tha
