Path Traversal Vulnerability in Quasar Framework Affecting @quasar/app-vite

CVE-2026-106108

What is CVE-2026-106108?

The Quasar Framework's @quasar/app-vite, versions 3.1.0 to 3.3.0, contains a vulnerability that allows for directory traversal due to improper validation of supply dir and filename values in the getSsgPages() method. This can lead to the creation of new HTML files or directories outside of the intended output directory, leveraging the build user's permissions. Although application configuration and SSG page definitions are considered trusted, the potential for exploitation increases when these definitions are derived from external or less-trusted sources. The issue has been remediated in version 3.3.0, enhancing the security posture by ensuring proper path validation in build processes.

References