i18next-fs-backend Path Traversal Vulnerability (CVE-2026-41693) Advisory

Vulnerability Summary: i18next-fs-backend Path Traversal Vulnerability Overview In versions prior to 2.6.4, the and options were directly interpolated into the configured or templates used to read files from disk. Due to the lack of escaping or validation in the interpolation process, an attacker can influence the path the backend attempts to read by crafting or values containing (path separators), control characters, prototype keys, or excessively long strings. This allows for the reading or overwriting of files outside the target directory. Affected Versions Affected Versions: < 2.6.4 Severity: High (CVSS v3 Base Score: 8.2/10) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: Low Availability: None Specific Impacts: 1. Arbitrary File Reading: Any file accessible by the Node.js process (including source code, configuration files, SSH keys, environment variables, Docker secrets, etc.) may become accessible via the local loading code path. 2. Arbitrary File Overwrite: If the path is enabled, an attacker can write a controlled JSON block to an arbitrary file system location, potentially implanting malicious configuration or code. 3. Denial of Service: Caused by extremely long paths or length-limited redirects. Remediation Upgrade Version: Upgrade to version 2.6.4 or later. Patch Mechanism: Version 2.6.4 introduced a single sanitization layer, (along with the helper function). This function is called from all locations that invoke / templates. If any replacement value fails the security check, returns , and the caller subsequently refuses to access the file system and reports an error. Temporary Workaround: If an immediate upgrade is not possible, sanitize and values at the application boundary for each request. Reject any values containing , , , , spaces, or control characters, and enforce a length limit (e.g., 128 characters). References CVE ID: CVE-2026-41693 CWE: CWE-22 (Path Traversal) GHSA: GHSA-8847-338w-5hqc

Goal Reached Thanks to every supporter — we hit 100%!

i18next-fs-backend Path Traversal Vulnerability (CVE-2026-41693) Advisory