PT-2026-30911 · Unknown · Coursevault-Preview

Kevinjohannesen · Published 2026-04-07 · Updated 2026-05-01 · CVE-2026-35613

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions coursevault-preview versions prior to 0.1.1

Description coursevault-preview is a utility for previewing course material files from a configured directory. The software contains a path traversal issue in the resolveSafe utility. The boundary check uses String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker controlling the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir if a sibling directory exists with a matching string prefix.

Recommendations Update to version 0.1.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35613

GHSA-9H9M-RR67-9JPG

Affected Products

Coursevault-Preview

References · 6

• https://osv.dev/vulnerability/GHSA-9h9m-rr67-9jpg · Vendor Advisory
• https://github.com/moritzmyrz/coursevault-preview/security/advisories/GHSA-9h9m-rr67-9jpg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35613 · Security Note
• https://github.com/moritzmyrz/coursevault-preview · Note
• https://t.me/cveNotify/161801 · Telegram Post
• https://twitter.com/CVEnew/status/2041569983214567893 · Twitter Post