CVE-2026-69153: CVE-2026-69153: Arbitrary File Read via Path Traversal in PostCSS

#security #cve #cybersecurity

CVE-2026-69153: Arbitrary File Read via Path Traversal in PostCSS

Vulnerability ID: CVE-2026-69153
CVSS Score: 6.3
Published: 2026-08-03

A directory traversal and arbitrary file read vulnerability exists in PostCSS due to an incomplete fix of CVE-2026-45623. When parsing a CSS file containing a sourceMappingURL comment with the 'from' parameter unset, path traversal and absolute path validations are bypassed, enabling attackers to read arbitrary local .map files.

TL;DR

PostCSS fails to validate sourceMappingURL paths when the 'from' option is omitted, allowing unauthenticated attackers to read arbitrary local .map files.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22
Attack Vector: Network
CVSS v4.0: 6.3
Impact: Confidentiality (Partial File Disclosure)
Exploit Status: Proof of Concept
KEV Status: Not Listed

Affected Systems

Applications running server-side PostCSS compilation libraries without configuring the 'from' parameter.
postcss: < 8.5.19 (Fixed in: 8.5.19)
postcss: >= 8.5.20 < 8.5.23 (Fixed in: 8.5.23)

Code Analysis

Commit: 7beca13

Does no load source map file without opts.from

@@ -21,11 +21,3 @@ loadFile(path, cssFile, trusted) {
-      if (cssFile) {
-        let relativePath = relative(dirname(cssFile), path)
-        if (
-          relativePath === '..' ||
-          relativePath.startsWith('..' + sep) ||
-          isAbsolute(relativePath)
-        ) {
-          return undefined
-        }
-      }
+      if (!cssFile) return undefined

Mitigation Strategies

Upgrade PostCSS to version 8.5.19, 8.5.23 or newer.
Always set the 'from' option in options when running PostCSS on untrusted input.
WAF rules to filter or sanitize CSS files containing directory traversal indicators in sourceMappingURL.

Remediation Steps:

Run 'npm install postcss@latest' to update the dependency to the secure version.
Inspect source code for usages of postcss().process() or postcss.parse().
Verify that the 'from' option is configured with a valid path prefix on all input CSS parsing pipelines.

References

Read the full report for CVE-2026-69153 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community