{"id":"CVE-2026-109823","published":"2026-10-27T16:17:29.157","lastModified":"2026-10-27T16:17:29.157","description":"An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.\n\nNeither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout.\n\nThis issue affects tidewave: from 0.8.0 before 0.9.2.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-497"],"vendors":[],"products":[],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-109823.html","tags":[]},{"url":"https://github.com/tidewave-ai/tidewave_phoenix/commit/80159536f752dc4d34797934d1516f29cea12b50","tags":[]},{"url":"https://github.com/tidewave-ai/tidewave_phoenix/commit/f78352b56d19cd4ae49999aa385011cef73e8b93","tags":[]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-109823","tags":[]}],"exploitRefs":[{"url":"https://github.com/tidewave-ai/tidewave_phoenix/commit/80159536f752dc4d34797934d1516f29cea12b50","tags":[]},{"url":"https://github.com/tidewave-ai/tidewave_phoenix/commit/f78352b56d19cd4ae49999aa385011cef73e8b93","tags":[]}],"hasPoc":true,"ai":null}