CVE-2026-7120

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.

• CWE-180

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmjVendor Advisory

Published

Jul 23, 2026

Last Modified

Jul 28, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7117A weakness has been identified in code-projects Employee Man…6.3
• CVE-2026-7118A security vulnerability has been detected in code-projects …6.3
• CVE-2026-7119A vulnerability was detected in Tenda HG3 2.0. The impacted …8.8
• CVE-2026-71190In OpenStack Swift through 2.38.0, the proxy server Accept h…8.7
• CVE-2026-71191In OpenStack Swift through 2.38.0, S3API middleware does not…6
• CVE-2026-71192In OpenStack Swift through 2.38.0, the S3API middleware does…6
• CVE-2026-71201In OpenStack Ironic through 38.0.0, a project reader that ma…5
• CVE-2026-71202The raster Rust crate's crop function (src/editor.rs) clamps…7.5
• CVE-2026-71203changedetection.io's REST API resources are protected by an …5.3
• CVE-2026-71204changedetection.io's /settings save handler builds an update…6.2
• CVE-2026-71205changedetection.io's /login route checks the submitted passw…6.5
• CVE-2026-71206Shiori's CheckToken function (internal/domains/auth.go) vali…8.3