CVE-2026-76844: 
Grafana vulnerability analysis and mitigation

CVE-2026-76844 is a path traversal vulnerability in the webpack-dev-middleware npm package, specifically in the getFilenameFromUrl function. It is an incomplete fix for CVE-2024-29180: the traversal guard (UP_PATH_REGEXP) and offset-slice logic introduced by that prior fix can be bypassed when publicPath is configured without a trailing slash. Affected versions span 5.3.4, 6.1.2–6.1.3, 7.1.0–7.4.5, and 8.0.0–8.1.1. Disclosed on August 24, 2026, it carries a CVSS v3.1 score of 7.4 (High) and a CVSS v4.0 score of 8.3 (High) (GitHub Advisory).

The root cause (CWE-22: Path Traversal) lies in a mismatch between the traversal guard and the file path construction logic in getFilenameFromUrl. The guard UP_PATH_REGEXP is applied to path.normalize('./${pathname}') and only matches .. that appears as a standalone path segment delimited by slashes. However, the file path is built by slicing pathname at a fixed character offset equal to publicPathPathname.length and passing the result to path.join(outputPath, ...). When publicPath is set to a value without a trailing slash (e.g., /assets), a crafted request like GET /assets../.env produces the pathname /assets../.env. The .. sits inside the segment assets.. and is not detected by the guard, but the offset slice cuts within that segment, handing ../.env to path.join, which resolves one directory above outputPath. Exploitation requires the middleware to be backed by the physical filesystem (writeToDisk: true or a custom outputFileSystem); the default in-memory memfs volume is not affected. Traversal depth is limited to a single directory level because URL parsing collapses separately delimited .. segments before the guard runs (GitHub Advisory, middleware source).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the parent directory of the configured outputPath on the server's physical filesystem. Sensitive files such as .env (containing API keys, database credentials, or secrets), configuration files, and private source code could be exfiltrated. There is no integrity or availability impact; the vulnerability is limited to confidentiality loss, scoped to one directory level above outputPath (GitHub Advisory).

As of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The NVD SSVC assessment classifies exploitation status as "poc" (indicating PoC-level knowledge exists in the advisory description), with automation rated "no" and technical impact "partial." The EPSS score is approximately 0.37% (30th percentile), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a non-default configuration (writeToDisk: true or custom outputFileSystem) and a publicPath without a trailing slash (GitHub Advisory).

1. Reconnaissance: Identify development servers running webpack-dev-middleware with publicPath configured without a trailing slash (e.g., /assets) and writeToDisk: true or a custom outputFileSystem. These are typically internal development environments, but may be exposed on local networks or public IPs.
2. Identify the publicPath: Observe the URL prefix used by the development server for serving webpack assets (e.g., /assets) by browsing the application or inspecting network traffic.
3. Craft the traversal request: Construct a GET request where the traversal payload is embedded within the publicPath prefix segment, e.g., GET /assets../.env HTTP/1.1. The .. is embedded inside the segment assets.., bypassing the UP_PATH_REGEXP guard.
4. Send the request: Issue the crafted HTTP request directly to the development server (e.g., curl http://target:8080/assets../.env).
5. Retrieve the file: If the server is configured with physical filesystem access, the middleware resolves the path to <outputPath>/../.env and returns the file contents in the HTTP response, exposing secrets or configuration data (GitHub Advisory).

• Network: Unusual HTTP GET requests to paths matching the pattern /<publicPath>../<filename> (e.g., /assets../.env, /assets../.git/config) in web server access logs; requests to the development server from unexpected IP addresses.
• Logs: Web server or Node.js access logs showing requests with path segments like assets.. immediately followed by /.env, /.git, or other sensitive filenames; HTTP 200 responses to such requests when the server is configured with physical filesystem access.
• Process: Unexpected outbound connections from the Node.js development server process following file read requests, potentially indicating data exfiltration after credential theft.

A patch is available; users should update webpack-dev-middleware to a fixed version beyond the affected ranges (5.3.4, 6.1.2–6.1.3, 7.1.0–7.4.5, 8.0.0–8.1.1). As immediate workarounds: (1) ensure publicPath is configured with a trailing slash (e.g., "/assets/" instead of "/assets"); (2) avoid setting writeToDisk: true in development environments; (3) use the default memfs in-memory filesystem, which is not vulnerable since it only contains build output. Development servers should not be exposed to untrusted networks (GitHub Advisory).

The vulnerability was noted by automated security tracking services and aggregators shortly after disclosure on August 24, 2026, including VulnDB, CVE.report, and Radar/OffSeq. A Mastodon post by RedPacketSecurity flagged the advisory. No significant vendor statements or notable researcher commentary beyond the advisory itself have been identified at this time (GitHub Advisory).