CVE-2026-6636: p2r3 convert Path Traversal Vulnerability

CVE-2026-6636 Overview

A path traversal vulnerability has been identified in p2r3 convert, specifically affecting the Bun.serve function within the buildCache.js file of the API component. The vulnerability allows attackers to manipulate the pathname argument to traverse directories outside of intended paths, potentially exposing sensitive files and system information. This security flaw can be exploited remotely over the network, making it a significant concern for deployments exposed to untrusted networks.

Critical Impact

Remote attackers can exploit this path traversal vulnerability to read arbitrary files on the server by manipulating the pathname parameter, potentially leading to sensitive information disclosure and further system compromise.

Affected Products

• p2r3 convert (up to commit 6998584ace3e11db66dff0b423612a5cf91de75b)
• Bun.serve API component in buildCache.js
• Rolling release versions prior to the vulnerability disclosure

Discovery Timeline

• 2026-04-20 - CVE-2026-6636 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6636

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The flaw exists in how the Bun.serve function within buildCache.js processes user-supplied pathname values without adequate validation or sanitization. When an attacker submits specially crafted path sequences such as ../ patterns, the application fails to properly restrict file access to the intended directory, allowing navigation to parent directories and access to files outside the web root or designated paths.

The vulnerability is particularly concerning because p2r3 convert uses a rolling release model, meaning there are no discrete version numbers to track affected installations. The vendor was contacted regarding responsible disclosure but did not respond, leaving the exploit publicly available without an official patch.

Root Cause

The root cause of this vulnerability lies in insufficient input validation of the pathname parameter passed to the Bun.serve function. The application does not properly sanitize or validate path inputs to prevent directory traversal sequences. Without proper canonicalization of file paths and validation against a whitelist of allowed directories, attackers can bypass intended access restrictions by injecting relative path components like ../ or encoded variants.

Attack Vector

The attack can be initiated remotely over the network. An attacker sends a malicious HTTP request to the API endpoint with a crafted pathname parameter containing directory traversal sequences. The Bun.serve function processes this input without proper sanitization, resolving the path to locations outside the intended directory structure. This allows the attacker to read sensitive files such as configuration files, credentials, or other system data accessible by the application process.

The vulnerability requires low privileges to exploit and does not require user interaction, making it accessible to any authenticated attacker with network access to the affected API endpoint.

Detection Methods for CVE-2026-6636

Indicators of Compromise

• HTTP requests containing path traversal patterns such as ../, ..%2f, %2e%2e/, or similar encoded sequences in pathname parameters
• Unusual access patterns to the buildCache.js API endpoint with suspicious path values
• Web server logs showing requests for sensitive system files like /etc/passwd, configuration files, or other files outside the application directory
• Multiple failed or unusual file access attempts originating from the same source

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Configure intrusion detection systems (IDS) to alert on requests containing directory traversal sequences targeting the affected API
• Enable verbose logging for the Bun.serve component to capture all pathname values for forensic analysis
• Monitor for anomalous file system access patterns from the application process

Monitoring Recommendations

• Review web server access logs regularly for suspicious pathname values containing traversal sequences
• Set up automated alerts for requests to the buildCache.js API that include ../ patterns or URL-encoded equivalents
• Monitor file access events at the operating system level for reads outside the application's designated directories
• Implement security information and event management (SIEM) rules to correlate potential exploitation attempts

How to Mitigate CVE-2026-6636

Immediate Actions Required

• Restrict network access to the affected API endpoint using firewall rules or network segmentation to limit exposure to trusted networks only
• Implement input validation at the web server or reverse proxy level to reject requests containing path traversal patterns
• Review and restrict file system permissions for the user account running the Bun.serve process
• Consider disabling the affected API functionality until a patch is available if it is not business-critical

Patch Information

No official patch is currently available from the vendor. The vendor was contacted about this disclosure but did not respond. Organizations using p2r3 convert should monitor the GitHub Security Advisory for updates. Additional vulnerability details are available at the VulDB entry.

Since p2r3 convert uses a rolling release model, users should pull the latest commits from the repository and verify whether the path traversal issue has been addressed in the buildCache.js file before deploying.

Workarounds

• Deploy a reverse proxy or web application firewall (WAF) in front of the application to filter out requests containing path traversal sequences before they reach the vulnerable component
• Implement custom middleware to validate and canonicalize all pathname inputs, rejecting any that resolve outside the intended directory
• Use operating system-level access controls such as chroot jails or containerization to limit the files accessible by the application process
• If possible, modify the buildCache.js file locally to add proper path validation using functions like path.resolve() combined with verification that the resolved path remains within the allowed directory

# Example: Using a reverse proxy rule to block path traversal (nginx)
location /api/ {
    if ($request_uri ~* "\.\.") {
        return 403;
    }
    proxy_pass http://localhost:3000;
}