CVE-2026-63188: Logto Tunnel Path Traversal Vulnerability

CVE-2026-63188 Overview

CVE-2026-63188 is a path traversal vulnerability [CWE-22] in the Logto Tunnel npm package, part of the Logto open-source authentication infrastructure for SaaS and AI applications. Versions prior to 0.3.9 fail to normalize or contain URLs passed to the static file proxy. An unauthenticated attacker who can reach the tunnel port can send crafted paths containing ../ sequences to read arbitrary files readable by the logto-tunnel process. The issue is fixed in version 0.3.9.

Critical Impact
Unauthenticated remote attackers can read arbitrary files outside the configured static directory when --experience-path is enabled, exposing source code, configuration, and credentials accessible to the tunnel process.

Affected Products

Logto Tunnel npm package (@logto/tunnel) versions prior to 0.3.9
Deployments where --experience-path is enabled
Deployments where the tunnel port is reachable by external hosts

Discovery Timeline

2026-08-19 - CVE-2026-63188 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-63188

Vulnerability Analysis

The Logto Tunnel exposes a static file proxy via createStaticFileProxy defined in packages/tunnel/src/commands/tunnel/index.ts. The proxy accepts incoming HTTP requests and forwards the request.url value to a helper in packages/tunnel/src/commands/tunnel/utils.ts. That helper constructs a filesystem path with path.join(staticPath, request.url) and opens the resulting file via fs.open(requestPath, "r").

Because request.url is not normalized and no containment check verifies the resolved path remains inside staticPath, an attacker can supply a URL containing ../ sequences to escape the static directory. Any file readable by the logto-tunnel process becomes accessible. The service binds using server.listen(port) without restricting to loopback, which may expose the tunnel to other hosts depending on the platform and deployment configuration.

Root Cause

The root cause is missing input sanitization and lack of a path containment check in the static file proxy. path.join collapses ../ segments but does not confirm the final path stays within the intended base directory. The code trusts client-supplied URL data and passes it directly to filesystem operations.

Attack Vector

An unauthenticated attacker with network access to the tunnel port sends an HTTP request whose URL contains directory traversal sequences. For example, a request path referencing ../../../../etc/passwd resolves outside staticPath and returns the target file contents. Exploitation requires no credentials, no user interaction, and low attack complexity. Full technical details are available in the Logto GitHub Security Advisory GHSA-rxjr-6c9q-h67x.

Detection Methods for CVE-2026-63188

Indicators of Compromise

HTTP requests to the tunnel port containing ../ or URL-encoded traversal sequences such as %2e%2e%2f in the request path
Access log entries showing responses to static file requests referencing paths outside the configured staticPath
Unexpected fs.open activity by the logto-tunnel process targeting sensitive files such as /etc/passwd, .env, or private key locations

Detection Strategies

Inspect tunnel access logs for request URLs containing traversal patterns (../, ..\\, %2e%2e)
Monitor process-level file access by the logto-tunnel user for reads outside the intended static asset directory
Alert on any tunnel HTTP 200 responses whose served path does not resolve to a file under staticPath

Monitoring Recommendations

Enable verbose request logging on the Logto Tunnel and forward logs to a centralized SIEM for pattern analysis
Baseline normal static asset request paths and flag deviations
Track outbound network exposure of the tunnel port and alert when it becomes reachable from non-loopback interfaces

How to Mitigate CVE-2026-63188

Immediate Actions Required

Upgrade @logto/tunnel to version 0.3.9 or later, which introduces URL normalization and a containment check
Restrict the tunnel port to loopback or trusted internal networks using firewall or host binding controls
Audit tunnel access logs for prior exploitation attempts referencing ../ sequences
Rotate any credentials, tokens, or secrets that were accessible to the logto-tunnel process

Patch Information

The fix is delivered in the @logto/tunnel@0.3.9 release. The corrective changes are described in Pull Request #9113 and applied in commit 5686815. Upgrade using the standard npm workflow.

Workarounds

Disable --experience-path if the static file proxy is not required
Bind the tunnel to 127.0.0.1 and route external traffic through a reverse proxy that validates request paths
Run the logto-tunnel process under a least-privileged user account so that a successful traversal exposes minimal files

bash

# Upgrade the Logto Tunnel package to the patched release
npm install @logto/tunnel@0.3.9

# Verify the installed version
npm ls @logto/tunnel