Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-42598

Pode: Directory Traversal is possible on Static Routes

Description

Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP servers. From 2.4.0, to before 2.13.0, when requesting content from a Static Route, it was possible to request paths such as http://localhost:8080/c:/Windows/System32/drivers/etc/hosts and have the contents returned. This vulnerability is fixed in 2.13.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Badgerati Pode

  • < 2.13.0affected

References