CVE-2026-63188: CVE-2026-63188: Unauthenticated Directory Traversal in @logto/tunnel

#security #cve #cybersecurity

CVE-2026-63188: Unauthenticated Directory Traversal in @logto/tunnel

Vulnerability ID: CVE-2026-63188
CVSS Score: 8.7
Published: 2026-08-19

A high-severity path traversal vulnerability exists in the @logto/tunnel npm package (part of the Logto repository) prior to version 0.3.9. Remote unauthenticated attackers can exploit this vulnerability to read arbitrary local files by sending crafted HTTP requests with directory traversal sequences when the static file proxy is active.

TL;DR

Unauthenticated remote directory traversal in @logto/tunnel < 0.3.9 allows arbitrary file read via crafted GET requests when custom experience hosting is enabled.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22
Attack Vector: Network (AV:N)
CVSS Score: 8.7 (High)
Exploit Status: Proof-of-Concept
KEV Status: Not Listed
Impact: Unauthenticated Arbitrary File Read (Confidentiality: High)

Affected Systems

@logto/tunnel < 0.3.9
Logto deployments containing @logto/tunnel packages < 0.3.9
@logto/tunnel: < 0.3.9 (Fixed in: 0.3.9)

Code Analysis

Commit: 5686815

fix(tunnel): secure static file proxy path resolution against directory traversal

Mitigation Strategies

Upgrade @logto/tunnel to version 0.3.9 or higher.
Restrict network access to the tunnel port by binding exclusively to localhost.
Implement firewall rules to block untrusted external requests to the tunnel ports.

Remediation Steps:

Identify all environments executing @logto/tunnel.
Update package.json dependencies to target @logto/tunnel version 0.3.9 or higher.
Execute npm update @logto/tunnel or yarn upgrade @logto/tunnel to pull the fixed release.
Verify the server config enforces localhost-only bindings if deployed for local-only testing.

References

Read the full report for CVE-2026-63188 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community