CVE-2026-35613

coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix.

Details

The vulnerable code in src/utils/errors.ts:

if (!full.startsWith(base)) {   // ← insufficient
  throw new Error("Path escapes the base directory");
}

Because the check is a raw string prefix test rather than a path-boundary test, the following bypass is possible:

baseDir  = "/srv/courses"
payload  = "../courses-admin/config.json"
resolved = "/srv/courses-admin/config.json"

"/srv/courses-admin/config.json".startsWith("/srv/courses") // → true ✗

Any file whose absolute path begins with the baseDir string, including files in sibling directories that share a name prefix, passes the guard and can be accessed by the caller through affected file-access methods.

The fix replaces the check with a separator-aware comparison:

if (full !== base && !full.startsWith(base + sep)) {
  throw new Error("Path escapes the base directory");
}

An application that passes untrusted input as the relativePath argument to affected file-access methods may expose file contents outside the intended directory.

1. Attacker control over the relativePath parameter.
2. A sibling directory on the filesystem whose name shares a string prefix with baseDir.

There is no network exposure in the package itself; impact is limited to local file disclosure within the host process's file system permissions.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

CVE-2026-35613 has a CVSS score of 5.1 (Medium). The vector is requires local access, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.1.1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-35613? CVE-2026-35613 is a medium-severity path traversal vulnerability in coursevault-preview (npm), affecting versions < 0.1.1. It is fixed in 0.1.1. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. How severe is CVE-2026-35613? CVE-2026-35613 has a CVSS score of 5.1 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of coursevault-preview are affected by CVE-2026-35613? coursevault-preview (npm) versions < 0.1.1 is affected.
4. Is there a fix for CVE-2026-35613? Yes. CVE-2026-35613 is fixed in 0.1.1. Upgrade to this version or later.
5. Is CVE-2026-35613 exploitable, and should I be worried? Whether CVE-2026-35613 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-35613 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-35613? Upgrade coursevault-preview to 0.1.1 or later.