Cloudanix VulnDB

CVE-2026-73646

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Aug 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in a tool that handles CSS files could let attackers read files they are not supposed to see on the server.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Path Traversal
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

The vulnerability allows attacker-controlled sourceMappingURL values in untrusted CSS input to be passed through join(dirname(opts.from), annotation) in loadMap() and loadFile(), enabling path traversal or absolute paths to arbitrary reachable .map files and disclosure of their sourcesContent when processed without map: false.

Why it matters to the business

Attackers can read arbitrary reachable source map files from the server filesystem, exposing proprietary code, configuration, or other sensitive data and increasing the risk of follow-on attacks against affected Red Hat Prometheus deployments.

How an attack unfolds

An attacker supplies crafted CSS containing a malicious sourceMappingURL with traversal sequences or absolute paths to a reachable .map file; the library resolves and loads the map without sufficient path validation, returning its sourcesContent in the transformation result.

How to fix it

Upgrade affected packages to the fixed versions: prometheus3-13-main to 3.13.2-0.2.hum1 and prometheus3-5-main to 3.5.5-0.8.hum1 via RHSA-2026:50287. Disable map processing when untrusted CSS must be handled if immediate upgrade is not possible.

How to confirm the fix worked

Confirm installed package versions match or exceed the listed fixed releases; test by submitting CSS with traversal sourceMappingURL values and verify that sourcesContent from unauthorized .map files is no longer returned.

Typical attack path

  1. Craft malicious CSS containing a sourceMappingURL with ../ traversal or absolute path to a target .map file
  2. Submit the CSS for processing by the vulnerable PostCSS library without map: false
  3. Receive the result.map containing sourcesContent from the attacker-chosen .map file

How to detect it

Inspect application and library logs for CSS processing events that reference sourceMappingURL values containing path traversal sequences or unexpected absolute paths; correlate with file access attempts to .map files outside expected directories.

What your security team should do

  • Apply the Red Hat security updates RHSA-2026:50287 to all affected prometheus3 packages without delay
  • Review and restrict CSS processing to trusted input only or enforce map: false
  • Scan dependency trees for any other PostCSS versions prior to 8.5.18

The record

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities