CVE-2026-42259 Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
Attackers can redirect users to malicious sites after login via a backslash bypass in the destination parameter, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42259?
CVE-2026-42259 is a medium-severity vulnerability in saltcorn, published on 7 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward slashes (/) for special schemes, a payload such as /\evil.com/path slips through is_relative_url(), is emitted unchanged in the HTTP Location header, and causes the browser to navigate cross-origin to an attacker-controlled domain. The bug is reachable on a default install and only requires a victim who can be tricked into logging in via a crafted Saltcorn URL. This issue has been patched in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.
Weakness: CWE-601
Which versions are affected by CVE-2026-42259?
6 open source packages ship an affected version, including @saltcorn/server.
| Package | Affected | Fixed in |
|---|---|---|
@saltcorn/server npm | All versions | 1.4.6 |
@saltcorn/server npm | All versions | 1.4.6 |
@saltcorn/server npm | From 1.5.0-beta.0 | 1.5.6 |
@saltcorn/server npm | From 1.5.0-beta.0 | 1.5.6 |
@saltcorn/server npm | From 1.6.0-alpha.0 | 1.6.0-beta.5 |
@saltcorn/server npm | From 1.6.0-alpha.0 | 1.6.0-beta.5 |
How do I fix CVE-2026-42259?
Upgrade @saltcorn/server to a fixed version for your release line: 1.4.6, 1.5.6 or 1.6.0-beta.5.
Is CVE-2026-42259 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42259 exists.
Sources
Also known as GHSA-f3g8-9xv5-77gv.