CVE-2026-63225

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.

• CWE-22
• CWE-73

• https://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee
• https://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3
• https://github.com/Redocly/redocly-cli/pull/2891
• https://github.com/Redocly/redocly-cli/pull/2923
• https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17
• https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2
• https://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2

Published

Sep 16, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63219GeoNetwork is a catalog application to manage spatially refe…8.6
• CVE-2026-6322fast-uri normalize() decoded percent-encoded authority delim…7.5
• CVE-2026-63220CodeIgniter is a PHP full-stack web framework. In versions p…4.8
• CVE-2026-63221CodeIgniter is a PHP full-stack web framework. From 4.3.0 th…9.4
• CVE-2026-63222CodeIgniter is a PHP full-stack web framework. Prior to 4.7.…7.5
• CVE-2026-63223CodeIgniter is a PHP full-stack web framework. Prior to 4.7.…9.8
• CVE-2026-63226Printers and Multifunction Printers (MFPs) provided by Ricoh…6.9
• CVE-2026-63227An unrestricted SCORM file upload vulnerability in Koollab L…9.9
• CVE-2026-63228An unrestricted image upload vulnerability in Koollab LMS al…2.6
• CVE-2026-63229A pre-authentication blind SQL injection vulnerability in Ko…9.1
• CVE-2026-63230A pre-authentication error-based SQL injection vulnerability…9.1
• CVE-2026-63231A post-authentication SQL injection vulnerability in Koollab…8.1