CVE-2026-63188: 
JavaScript vulnerability analysis and mitigation

CVE-2026-63188 is a path traversal vulnerability in the @logto/tunnel npm package (part of the Logto open-source auth infrastructure) that allows unauthenticated attackers to read arbitrary files outside the configured --experience-path static directory. All versions up to and including 0.3.8 are affected; the issue was fixed in version 0.3.9. The vulnerability was originally published on July 2, 2026, and added to the GitHub Advisory Database on August 19, 2026. It carries a CVSS v4.0 base score of 8.7 (High) (Github Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In packages/tunnel/src/commands/tunnel/utils.ts, the createStaticFileProxy function constructs the filesystem path using path.join(staticPath, request.url) and then opens the result with fs.open(requestPath, 'r') — without first normalizing the URL or verifying that the resolved path remains within staticPath. Because Node.js preserves /../ sequences in request.url, an attacker can supply a URL such as /../secret.txt to escape the static root. Additionally, server.listen(port) binds to all network interfaces by default, potentially exposing the tunnel to remote hosts. No authentication is required to reach the static file proxy endpoint (Github Advisory, Fix PR).

Successful exploitation grants an unauthenticated attacker arbitrary file read access to any file on the host system that is readable by the logto-tunnel process. This can expose sensitive development artifacts such as .env files, SSH private keys, API credentials, or other secrets stored near the custom UI project directory. There is no integrity or availability impact, but the confidentiality breach could facilitate lateral movement or privilege escalation if credentials or tokens are disclosed (Github Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only network access to the tunnel port and no authentication, making it trivially exploitable once the precondition (tunnel running with --experience-path) is met (Github Advisory, Feedly).

1. Reconnaissance: Identify hosts running logto-tunnel with the --experience-path option enabled and the tunnel port (e.g., 9000) accessible over the network, using port scanners such as Nmap or Shodan.
2. Confirm tunnel is active: Send a normal HTTP GET request to the tunnel port (e.g., http://<target>:9000/index.html) and verify a valid response is returned, confirming the static file proxy is active.
3. Craft path traversal request: Send an HTTP GET request with a path traversal sequence targeting a known sensitive file, for example:

   GET /../secret.txt HTTP/1.1
   Host: <target>:9000

4. Read arbitrary files: The server resolves the path outside the static root and returns the file contents in the HTTP response body. Repeat with targets such as /../.env, /../.ssh/id_rsa, or /../etc/passwd to enumerate sensitive files readable by the tunnel process.
5. Leverage disclosed secrets: Use any credentials, tokens, or keys found to escalate access to connected systems or the Logto cloud endpoint (Github Advisory).

• Network: Inbound HTTP GET requests to the tunnel port containing ../ or URL-encoded equivalents (%2e%2e%2f, %2e%2e%5c, ..%2f, ..%5c) in the request path; requests for non-static-asset paths such as /.env, /.ssh/id_rsa, or /etc/passwd.
• Logs: HTTP access logs for the tunnel process showing requests with traversal sequences (e.g., GET /../secret.txt, GET /%2e%2e%2f.env) returning HTTP 200 responses; unexpected 200 responses for paths outside the configured --experience-path directory.
• Process: The logto-tunnel process opening file descriptors to paths outside the configured static directory, observable via lsof or auditd file access logs.

Upgrade the @logto/tunnel npm package to version 0.3.9 or later, which introduces the getSafeStaticFilePath function that normalizes and validates request URLs — including URL-decoded variants and backslash sequences — before resolving file paths, and returns undefined (resulting in a 404) for any path that escapes the static root (Github Advisory, Release 0.3.9). As an interim workaround, restrict network access to the tunnel port using firewall rules so that only trusted hosts can reach it, since the service binds to all interfaces by default. Avoid running the tunnel with --experience-path in environments where the port is exposed to untrusted networks until the upgrade is applied.