decaporg vulnerabilities

Products

• decaporg/decap-cms 1

Latest decaporg CVEs

Newest publication first

1. CVE-2026-92812 Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching

   Published 2026-09-16

   Critical·CVSS 9.3

   Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.