CVE-2026-89065
Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.15%
- CWE
- CWE-23
- Published
- 2026-09-11
- Last modified
- 2026-09-11
Affected products
- AWS projen
Weakness type
Related vulnerabilities
- CVE-2025-64446 — A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
- CVE-2025-55752 — Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
- CVE-2025-34510 — Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
- CVE-2025-52207 — PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbit
- CVE-2026-33494 — Ory Oathkeeper has a path traversal authorization bypass
- CVE-2025-62878 — Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern
- CVE-2025-3365 — Relative Path Traversal in OnlineSuite
- CVE-2025-47445 — WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability