CVE-2026-104871

Executive Summary

CVE-2026-104871 is a path-confusion / relative path traversal issue in the Angular Server-Side Rendering (SSR) CommonEngine prerendered-page retrieval logic, affecting the @angular/ssr/node package and the @angular/ssr package for versions 17 through 18. Prior to versions 20.3.36, 21.2.23, and 22.1.7, an unauthenticated requester on a Windows deployment can cause the engine to retrieve a sibling prerendered HTML page by supplying a relative request URL containing a backslash parent-traversal segment. The impact is limited to disclosure of sibling prerendered HTML pages containing the Angular SSG marker; the issue does not provide arbitrary file read, and exploitation requires that the application passes relative request URLs to CommonEngine.render, that a prefix-sharing sibling output directory exists, and that qualifying prerendered Angular HTML is present.

Technical Analysis

The vulnerability is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) issue, realized through inconsistent URL/OS path parsing rather than through classic ../ file-read traversal.

According to the NVD description, the flaw resides in the CommonEngine retrieveSSGPage prerendered-page retrieval logic, present in @angular/ssr/node and in @angular/ssr for versions 17 through 18. The mechanism described is:

1. The engine accepts a relative request URL containing a backslash parent-traversal segment on Windows.
2. A non-special resolve:// URL base is used, which preserves the backslash character rather than normalizing it. On Windows, backslash is a path separator, so a segment that would be inert or treated as a literal character under a normal URL parsing context survives into the filesystem resolution stage.
3. path.join then interprets the preserved backslash as a Windows directory separator, allowing the joined path to escape the intended location.
4. The containment check pagePath.startsWith(normalize(publicPath)) is a string-prefix comparison. Because it is a prefix check rather than a true directory-boundary check, a sibling output directory whose name shares the configured public-directory prefix is incorrectly accepted. For example, a public path of ...\public would incorrectly accept a sibling ...\public-copy or similar prefix-sharing directory.
5. This allows retrieval of a sibling prerendered HTML page, but only when that page contains the Angular SSG marker. The description explicitly states this does not provide arbitrary file read.

Key constraints that define the true attack surface: the deployment must be Windows; the application must pass relative request URLs to CommonEngine.render; a sibling output directory sharing the configured public-directory prefix must exist; and qualifying prerendered Angular HTML content must be present. These constraints make the vulnerability a narrow information-disclosure issue rather than a general file-read primitive.

Insufficient technical detail is available regarding the exact normalization routine used by normalize(publicPath), the specific SSG marker string recognized, and the precise construction of the resolve:// base; the report does not speculate beyond what the advisory states.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-104871; the attack chain below is inferred from the vulnerability class and the mechanism described in the advisory.

1. Reconnaissance / target identification: The attacker identifies a Windows-hosted Angular application using SSR with prerendered (SSG) pages served through CommonEngine. Fingerprinting relies on observable Angular SSR characteristics (for example Angular application markers in HTML) and on knowledge that the deployment runs on Windows and returns relative request URLs to the render engine.

2. Triggering the flaw class: The attacker submits a request URL that is relative and contains a backslash parent-traversal segment (a Windows-style separator combined with a parent-directory segment). Because the request URL is processed against a non-special resolve:// base, the backslash is preserved; path.join subsequently treats it as a Windows separator and resolves the path outside the configured public directory. The prefix-based containment check (pagePath.startsWith(normalize(publicPath))) then passes for a sibling directory whose name shares the configured public-directory prefix.

3. Payload/execution at the vulnerability-class level: There is no code-execution payload. The "payload" is the crafted request path itself. Success depends on the target locating a sibling prerendered HTML file that contains the Angular SSG marker. If the marker is absent, retrieval is not served; this bounds the exploit to a specific file class.

4. Post-exploitation impact: Successful retrieval discloses a sibling prerendered HTML page. Per the advisory, the flaw does not provide arbitrary file read. Impact is therefore limited to information disclosure of content already intended to be served as prerendered pages, potentially revealing staging, alternate, or non-linked prerendered content that shares the public-directory prefix.

Impact Assessment

The vulnerability is a remotely reachable, unauthenticated information-disclosure issue (CVSS v3.1 base estimated at 3.7, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N; note that no official CVSS score or vector is provided in the source data). The Network attack vector and no-privileges/no-interaction requirements are offset by High attack complexity (Windows-only, specific directory layout, relative-URL usage, marker-dependent retrieval) and Low confidentiality impact.

The blast radius is confined to Windows deployments of affected Angular SSR versions that (a) pass relative request URLs to CommonEngine.render, (b) have a sibling output directory whose name shares the configured public-directory prefix, and (c) contain qualifying prerendered Angular HTML. Because no arbitrary file read is possible, integrity and availability are unaffected. Business risk centers on disclosure of prerendered page content — potentially unlisted or staging pages sharing the prefix — which may aid further reconnaissance or leak non-public but server-rendered material.

Detection Guidance

Sigma Rule

title: Angular SSR CommonEngine RetrieveSSGPage Backslash Traversal Attempt (CVE-2026-104871)
id: 8f3c1a2e-6b7d-4e5f-9a10-2c3d4e5f6a7b
status: experimental
description: Detects HTTP requests containing backslash parent-traversal segments indicative of CVE-2026-104871 exploitation against Angular SSR on Windows.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104871
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - HEAD
  selection_traversal:
    cs-uri-query|contains:
      - '\..'
      - '..\'
      - '\..\'
  condition: selection_method and selection_traversal
falsepositives:
  - Legitimate applications that transmit Windows-style paths in query parameters.
level: medium
tags:
  - attack.t1190
  - cve.2026-104871

YARA Rule

rule CVE_2026_104871_Angular_SSR_Backslash_Traversal
{
    meta:
        description = "Detects backslash parent-traversal patterns associated with CVE-2026-104871 in Angular SSR request logs"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104871"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $traversal1 = "\\..\\" ascii
        $traversal2 = "..\\" ascii
        $ssg_marker = "ng-server-context" ascii nocase

    condition:
        any of ($traversal*) and $ssg_marker
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104871 Angular SSR CommonEngine Backslash Path Traversal Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"\\.."; fast_pattern; classtype:attempted-recon; reference:cve,2026-104871; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104871; sid:2026104871; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and http.request.method in ("GET", "HEAD") and
   wildcard(http.request.uri, "*\\\\..*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=coalesce(uri, url, cs_uri_query)
| where match(uri, "\\\\\.\.") OR like(uri, "%5C%2E%2E%") OR like(uri, "%5c%2e%2e%")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,angular,cve-2026-104871,">
  <rule id="104871" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>\\\.\.</url>
    <description>CVE-2026-104871: Possible Angular SSR CommonEngine backslash path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Do not pass relative request URLs to CommonEngine.render; validate and normalize incoming paths to absolute, canonicalized values at the application/edge before rendering.
   • On Windows, reject or strip backslash characters and parent-traversal segments in request paths at the reverse proxy or WAF layer.
   • Ensure the configured public directory has no sibling directory sharing its name prefix, eliminating the prefix-check bypass precondition.
   • Restrict the deployment so qualifying prerendered HTML is only present in the intended public directory.

2. Patch/upgrade steps:

   • Upgrade @angular/ssr and @angular/ssr/node to versions 20.3.36, 21.2.23, or 22.1.7 (or later), which the advisory states contain the fix. Note that the tracked patch sources returned no confirmation; treat any upgrade verification as required. Apply the nearest supported fixed release for your major line.

3. Long-term hardening:

   • Treat all path-containment checks as directory-boundary checks (e.g., append a separator before prefix comparison) rather than raw string-prefix checks in SSR and file-serving code.
   • Enforce canonical path resolution across platforms, ensuring URL and filesystem parsing do not diverge on Windows separators.
   • Add automated regression tests for backslash traversal input in SSR prerender retrieval.
   • Monitor Angular SSR security advisories and track the CVE for an updated patch/KEV state.

References

• NVD — CVE-2026-104871: https://nvd.nist.gov/vuln/detail/CVE-2026-104871
• Angular / @angular/ssr security advisory (vendor release notes for 20.3.36, 21.2.23, 22.1.7)
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog: not listed (checked; no exploit-in-the-wild evidence provided). No known threat actor campaigns are associated with this CVE in the provided data.