CVE-2026-33129: Bypass Path Traversal Decodeuri
Decoding an HTTP request path using `decodeURI` or `decodeURIComponent` without subsequently removing or resolving dot segments can bypass simple path traversal protections. An attacker can send percent-encoded dot segments (e.g., `%2e%2e`) that bypass literal filters and get decoded into `..`, enabling directory traversal. Ensure you wrap the decoded path i
JSgreprules fetch cve-2026-33129-bypass-path-traversal-decodeuri --engine opengrepDescription
Decoding an HTTP request path using `decodeURI` or `decodeURIComponent` without subsequently removing or resolving dot segments can bypass simple path traversal protections. An attacker can send percent-encoded dot segments (e.g., `%2e%2e`) that bypass literal filters and get decoded into `..`, enabling directory traversal. Ensure you wrap the decoded path i
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0