CVE-2026-109823 PUBLISHED

Host filesystem path disclosure via DNS rebinding

Assigner: EEF
Reserved: 23.10.2026 Published: 27.10.2026 Updated: 27.10.2026

An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.

Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout.

This issue affects tidewave: from 0.8.0 before 0.9.2.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 2.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	None
User Interaction	Passive

CVSS 4.0

Product Status

Vendor	tidewave-ai
Product	tidewave
Versions	Default: unaffected affected from 0.8.0 to 0.9.2 (excl.)

Vendor	tidewave-ai
Product	tidewave
Versions	Default: unaffected affected from f78352b56d19cd4ae49999aa385011cef73e8b93 to 80159536f752dc4d34797934d1516f29cea12b50 (excl.)

Credits

Neil Berkman finder
Neil Berkman reporter
Jonatan Männchen / EEF coordinator

References

Problem Types

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE

Impacts

A malicious web page that a developer visits while the Phoenix development server runs can learn the developer's username, project location, and dependency layout on disk. This information helps an attacker prepare further attacks against the machine.