CVE-2026-49144CWE-22path-traversal

CVE-2026-49144

Medium · published June 3, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.1
In the wild
Unconfirmed
What it is

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-03T01:16Z
References (3)
https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-8rpw-6cqh-2v9h · [email protected]https://www.vulncheck.com/advisories/browserstack-runner-path-traversal-via-default-http-handler · [email protected]https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-8rpw-6cqh-2v9h · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 JUN 20:34Z
    BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler
    cvelistv5