Listen to this Post
CVE-2026-63188 is a path traversal vulnerability (CWE-22) in the `@logto/tunnel` npm package, which is used to serve custom sign-in experience files during Logto development workflows. The flaw allows an unauthenticated, network-based attacker to escape the configured static file directory and read arbitrary files accessible to the tunnel process.
The root cause lies in the static file handler within packages/tunnel/src/commands/tunnel/utils.ts. When the `–experience-path` option is enabled, the handler builds the target filesystem path using `path.join(staticPath, request.url)` and then opens it with fs.open(requestPath, 'r'). Critically, it does this without normalizing the URL or verifying that the resolved path stays within the configured static directory.
This means a request URL such as `/../secret.txt` resolves to a path outside the intended staticPath. The server is started with server.listen(port), which, depending on the platform and deployment, can expose the tunnel to other hosts on the network. An attacker can send a crafted HTTP request containing `../` sequences to the tunnel’s listening port to read files readable by the `logto-tunnel` process.
The impact is significant: it can lead to the disclosure of arbitrary files, potentially including configuration files, credentials, or other secrets stored on the host. This vulnerability affects all versions of `@logto/tunnel` prior to 0.3.9 and is fixed in version 0.3.9. It carries a CVSS score of 8.7 (High).
DailyCVE Form:
Platform: Logto Tunnel
Version: < 0.3.9
Vulnerability: Path Traversal
Severity: High (8.7)
Date: 2026-08-19
Prediction: 2026-08-20
What Undercode Say:
Analytics:
- CVE ID: CVE-2026-63188
- Published: 2026-08-19
- EPSS Score: Not yet available
- GitHub Advisory: GHSA-rxjr-6c9q-h67x
Exploit: (Educational Purposes!)
Create a custom UI directory and a sensitive file outside it mkdir -p /tmp/logto-ui/static echo "This is a secret" > /tmp/logto-ui/secret.txt echo "<html>OK</html>" > /tmp/logto-ui/static/index.html Start the vulnerable tunnel service logto-tunnel --endpoint https://<tenant-id>.logto.app --port 9000 --experience-path /tmp/logto-ui/static Exploit: Request a file outside the static directory using path traversal curl http://<host>:9000/../secret.txt Response body contains: "This is a secret"
Protection:
- Immediately upgrade `@logto/tunnel` to version 0.3.9 or later.
- If patching is not possible, avoid exposing the tunnel with `–experience-path` to untrusted networks.
- Restrict access to the tunnel’s listening port via firewall rules or network segmentation.
- Do not store secrets or sensitive files in or near the directory tree used as the static/experience path.
- Monitor logs for requests containing `../` sequences targeting the tunnel service.
Impact:
An unauthenticated network peer can read local files readable by the `logto-tunnel` process. This includes development secrets or credentials stored near the custom UI project, resulting in high confidentiality impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
