CVE-2026-35613: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35613 is a path traversal vulnerability in the coursevault-preview npm package, a utility for previewing course material files from a configured directory. Versions prior to 0.1.1 are affected. The vulnerability was published by the maintainer on April 5, 2026, disclosed to the NVD on April 7, 2026, and added to the GitHub Advisory Database on April 8, 2026. It carries a CVSS v3.1 base score of 4.7 (Medium) per NVD, or 5.1 (Moderate) per the GitHub Advisory (GitHub Advisory, Security Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerable code resides in src/utils/errors.ts, where the resolveSafe utility enforces a directory boundary using a raw string prefix check (String.prototype.startsWith(baseDir)) on a normalized path rather than a separator-aware comparison. This means that if baseDir is /srv/courses, a crafted path resolving to /srv/courses-admin/config.json passes the guard because the string /srv/courses-admin/config.json does indeed start with /srv/courses. The fix appends a path separator to the base directory before comparison: full.startsWith(base + sep), ensuring only paths within the actual directory are permitted (Security Advisory, GitHub Advisory).

Successful exploitation allows a local attacker to read arbitrary files outside the configured baseDir, limited to files accessible within the host process's filesystem permissions. The impact is confined to confidentiality — there is no integrity or availability impact, and no network exposure is introduced by the package itself. Sensitive files in sibling directories (e.g., configuration files containing credentials) could be disclosed if an attacker controls the relativePath argument passed to affected CoursevaultPreview methods (Security Advisory).

There is no confirmed in-the-wild exploitation or publicly available weaponized exploit code for this vulnerability. The GitHub Advisory analysis notes that the example payload (../courses-admin/config.json) is illustrative rather than a functional exploit. The EPSS score is approximately 0.014–0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Security Advisory).

1. Identify a vulnerable deployment: Locate an application using coursevault-preview < 0.1.1 (npm) where user-controlled input is passed as the relativePath argument to CoursevaultPreview file-access methods.
2. Identify a sibling directory: Determine whether a sibling directory exists on the filesystem whose name shares a string prefix with the configured baseDir (e.g., baseDir = /srv/courses and sibling /srv/courses-admin).
3. Craft a traversal payload: Construct a relative path that, when resolved against baseDir, produces an absolute path pointing to a file in the sibling directory — for example, ../courses-admin/config.json resolves to /srv/courses-admin/config.json.
4. Bypass the boundary check: The resolved path /srv/courses-admin/config.json passes the flawed startsWith('/srv/courses') check, allowing the file read to proceed.
5. Read the target file: The application returns the contents of the file outside baseDir, potentially exposing sensitive configuration data or credentials (Security Advisory).

• File System: Unexpected access to files in sibling directories adjacent to the configured baseDir (e.g., files under /srv/courses-admin/ when baseDir is /srv/courses).
• Logs: Application logs showing file read operations resolving to paths outside the intended baseDir; error logs that are notably absent where path traversal attempts succeed silently.
• Process: Unusual file read activity by the Node.js process serving coursevault-preview, particularly targeting configuration files (e.g., config.json, .env) in directories adjacent to the course content directory.

Upgrade coursevault-preview to version 0.1.1 or later, which replaces the flawed startsWith(baseDir) check with a separator-aware comparison (startsWith(base + sep)). No configuration-based workaround is available; the only effective remediation is upgrading the package. Developers should also audit any application code that passes untrusted user input as the relativePath argument to CoursevaultPreview methods (GitHub Advisory, Security Advisory).