CVE-2026-104871 Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
An attacker can retrieve sibling prerendered HTML pages on Windows deployments with specific directory structures, exposing limited data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104871?
CVE-2026-104871 is a medium-severity path traversal vulnerability in angular-cli, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.
Weakness: CWE-22
Which versions are affected by CVE-2026-104871?
8 open source packages ship an affected version, including @angular/ssr.
| Package | Affected | Fixed in |
|---|---|---|
@angular/ssr npm | All versions to 19.2.27 | None |
@angular/ssr npm | All versions to 19.2.27 | None |
@angular/ssr npm | From 20.0.0 | 20.3.36 |
@angular/ssr npm | From 20.0.0 | 20.3.36 |
@angular/ssr npm | From 21.0.0 | 21.2.23 |
@angular/ssr npm | From 21.0.0 | 21.2.23 |
2 more packages
@angular/ssr npm | From 22.0.0 | 22.1.7 |
@angular/ssr npm | From 22.0.0 | 22.1.7 |
How do I fix CVE-2026-104871?
Upgrade @angular/ssr to a fixed version for your release line: 20.3.36, 21.2.23 or 22.1.7.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-104871 being exploited?
There is no known exploitation of CVE-2026-104871 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1791302781, CLSA-2026-1791320260, CLSA-2026-1791320540, CLSA-2026-1791320698, CLSA-2026-1791322653, CLSA-2026-1792163463 and 41 more.