Directory Traversal Vulnerability in esm.sh Web Development CDN
CVE-2026-102657

7.5HIGH

Key Information:

Vendor: Esm-dev
Status: Esm.sh
Vendor: CVE Published:; 6 November 2026

What is CVE-2026-102657?

Prior to version 137_7, esm.sh, a no-build content delivery network for web development, introduced a vulnerability where the server's static file handler failed to properly validate URL paths. This oversight allowed an unauthenticated remote attacker to perform directory traversal, leading to potential exposure of sensitive files located outside the application's designated directory. The vulnerability could be exploited even with developer mode disabled, resulting in unauthorized file disclosures. The issue has been rectified in the latest server version.