CVE-2026-63188

Name of the Vulnerable Software and Affected Versions Logto Tunnel versions prior to 0.3.9

Description The Logto Tunnel npm package contains a flaw where the createStaticFileProxy function in packages/tunnel/src/commands/tunnel/index.ts processes static asset requests using path.join(staticPath, request.url) and fs.open(requestPath, "r") without performing URL normalization or containment checks. When the --experience-path flag is enabled and the tunnel port is accessible, an unauthenticated attacker can use path traversal sequences (e.g., ../) via the request.url variable to read files outside the intended static directory that the logto-tunnel process has permissions to access. Additionally, the use of server.listen(port) may expose the tunnel to other hosts depending on the deployment environment.

Recommendations Update to version 0.3.9.