CVE-2026-109823

The record

An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout. This issue affects tidewave: from 0.8.0 before 0.9.2.

Affected packages

Related vulnerabilities

• CVE-2026-111079 A flaw was found in Goose. CWE-497
• CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode… CWE-497
• CVE-2026-96865 Exposure of sensitive system information to an unauthorized control sphere in Windows… CWE-497
• CVE-2026-85866 Exposure of sensitive system information to an unauthorized control sphere in Windows… CWE-497
• CVE-2026-83909 Exposure of sensitive system information to an unauthorized control sphere in Windows… CWE-497
• CVE-2026-83907 Exposure of sensitive system information to an unauthorized control sphere in Windows… CWE-497
• CVE-2026-83905 Exposure of sensitive system information to an unauthorized control sphere in Windows… CWE-497
• CVE-2026-83835 Buffer over-read in Windows Common Log File System Driver allows an authorized attacker… CWE-497