PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Description

File: lib/previous-map.js Line: 87-98 (loadFile), 129-144 (loadMap)

Recommendation

Update the postcss package to the latest compatible version. Followings are version details:

• Affected version(s): <= 8.5.17
• Patched version(s): 8.5.18

References

• GHSA-r28c-9q8g-f849
• CVE-2026-73646
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments - CVE-2026-45623
• PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `f - CVE-2026-69153
• Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
• @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files - CVE-2026-33949

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Exploiting Server Version Disclosure

Update Cheat Sheet for Developers

Tags:

npm

postcss