DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2026-49030
Published Sep 13, 2026
CVSS n/a
EPSS n/a
KEV · Not listed
Description
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Analysis
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
No reference.
History
Sep 13, 2026 10:30 PM
References updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Sep 13, 2026 9:30 PM
Description updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | pathe through 2.0.3 unconditionally normalizes backslash characters to forward slashes on all platforms, including POSIX systems where backslash is a valid filename character. This causes join(), resolve(), and normalize() to interpret backslash-separated dot notation sequences as directory traversal, diverging from Node.js path.posix behavior and enabling path traversal attacks that bypass common input validation in server-side applications. NOTE: the Supplier reports that "the behavior is documented, intentional, and identical in spirit to path.win32." | DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. |
Sep 13, 2026 9:15 PM
Description updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | pathe through 2.0.3 unconditionally normalizes backslash characters to forward slashes on all platforms, including POSIX systems where backslash is a valid filename character. This causes join(), resolve(), and normalize() to interpret backslash-separated dot notation sequences as directory traversal, diverging from Node.js path.posix behavior and enabling path traversal attacks that bypass common input validation in server-side applications. NOTE: the Supplier reports that "the behavior is documented, intentional, and identical in spirit to path.win32." | |
| References |
|
Subscriptions
No data.
Weaknesses
No weakness.
