Filesystem Path Exposure Vulnerability in Tidewave by Tidewave AI
CVE-2026-109823

2.3LOW

Key Information:

Vendor

Tidewave-ai

Status
Tidewave
Vendor
CVE Published:
27 October 2026

What is CVE-2026-109823?

This vulnerability allows attackers to exploit the Tidewave configuration through the endpoints /tidewave/connect or the rendered toolbar. By manipulating the Host header, an attacker can perform a same-origin request to disclose sensitive filesystem paths, including local usernames and project structures, potentially exposing critical application data. This issue affects versions of Tidewave from 0.8.0 up to, but not including, 0.9.2.

Affected Version(s)

tidewave 0.8.0 < 0.9.2

tidewave f78352b56d19cd4ae49999aa385011cef73e8b93 < 80159536f752dc4d34797934d1516f29cea12b50

References

https://cna.erlef.org/cves/CVE-2026-109823.html
relatedthird-party-advisory
https://osv.dev/vulnerability/EEF-CVE-2026-109823
related
https://github.com/tidewave-ai/tidewave_phoenix/commit/f7...
related

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Neil Berkman
Neil Berkman
Jonatan Männchen / EEF
.