CVE-2026-73646— PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-73646
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-73646
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCVerified env Premium
Reproduced successfully in a real sandbox· Below is the actual recording of building the environment and exploiting the vulnerability.
Success marker:
VULNERABLE: sourceMappingURL traversal read /secret/app-secret.map and disclosed its sourcesContent (PROOF_052c20c92c70e3b5) through result.mapReproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+claude_code · 9719 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-73646
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-73646 (1)
Vendor Advisories for CVE-2026-73646 (1)
Vendor Pages for CVE-2026-73646 (1)
- 🔗 Release 8.5.18 · postcss/postcss · GitHubx_refsource_MISC
IV. Related Vulnerabilities
Same product: postcss
- CVE-2026-69153
PostCSS: incomplete fix of CVE-2026-45623 — attacker-control - CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via - CVE-2026-41305
PostCSS has XSS via Unescaped </style> in its CSS Stringify - CVE-2021-23382
Regular Expression Denial of Service (ReDoS) - CVE-2021-23368
Regular Expression Denial of Service (ReDoS)
Same weakness: CWE-22
- CVE-2026-19942
Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Del - CVE-2026-50186
4gaBoards: Path Traversal leading to Arbitrary File Read and - CVE-2026-52875
Streambert: Arbitrary Directory Creation and File Manipulati - CVE-2026-52872
Streambert: Local File Exfiltration and Overwrite via Subtit - CVE-2026-47699
Confidential Containers Guest Components image-rs: zip-slip-
V. Comments for CVE-2026-73646
No comments yet