CVE-2026-63188
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Logto Tunnel before version 0.3.9 contains a path traversal vulnerability in createStaticFileProxy. An unauthenticated attacker can send a request with a path containing '../' and read files outside the configured static directory if the tunnel port is reachable.
Risk Assessment
The risk is unauthorized access to system files that may contain sensitive data if the tunnel is exposed to the network.
Recommendation
Update the Logto Tunnel package to version 0.3.9 or later, which includes the fix.
Original NVD description (English source)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through packages/tunnel/src/commands/tunnel/utils.ts using path.join(staticPath, request.url) and then fs.open(requestPath, "r") without URL normalization or a containment check. When --experience-path was enabled and the tunnel port was reachable, an unauthenticated requester could send a path containing ../ to createStaticFileProxy and read files outside the configured static directory that were readable by the logto-tunnel process. The service used server.listen(port), which could expose the tunnel to other hosts depending on the platform and deployment. This issue is fixed in version 0.3.9.