CVE-2026-63188 logto-tunnel serves files outside --experience-path via path traversal
An unauthenticated attacker can read arbitrary files outside the static directory via path traversal in the Logto tunnel package when experience-path is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63188?
CVE-2026-63188 is a high-severity path traversal vulnerability in logto-io logto, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through packages/tunnel/src/commands/tunnel/utils.ts using path.join(staticPath, request.url) and then fs.open(requestPath, "r") without URL normalization or a containment check. When --experience-path was enabled and the tunnel port was reachable, an unauthenticated requester could send a path containing ../ to createStaticFileProxy and read files outside the configured static directory that were readable by the logto-tunnel process. The service used server.listen(port), which could expose the tunnel to other hosts depending on the platform and deployment. This issue is fixed in version 0.3.9.
Weakness: CWE-22
Which versions are affected by CVE-2026-63188?
2 open source packages ship an affected version, including @logto/tunnel.
| Package | Affected | Fixed in |
|---|---|---|
@logto/tunnel npm | All versions | 0.3.9 |
@logto/tunnel npm | All versions | 0.3.9 |
How do I fix CVE-2026-63188?
Upgrade @logto/tunnel to 0.3.9 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-63188 being exploited?
There is no known exploitation of CVE-2026-63188 in the wild and no public exploit code.
Sources
Also known as GHSA-rxjr-6c9q-h67x, MINI-43c2-qm78-m77j, MINI-62xh-2fmg-xhvx.