Path Traversal in Hono Web Application Framework Affects Windows Hosts

CVE-2026-54286

What is CVE-2026-54286?

The Hono Web Application Framework allows attackers on Windows hosts to exploit a path traversal vulnerability. Prior to version 4.12.25, an encoded backslash (%5C) in the request path is incorrectly interpreted by the Windows path resolver as a valid separator. This misinterpretation leads to unauthorized access to sensitive static files that should be protected by prefix-mounted middleware. As a result, attackers can gain access to files like admin\secret.txt, putting application security at risk. This vulnerability has been addressed in Hono version 4.12.25.

References