dbcve.org
Path TraversalWeakness · CWE-22

CVE-2026-44593

HIGH · 8.7 CVSS v4.0 Published 2026-05-28
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
96/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the legacy router first retrieves a response from legacyServer, parses the incoming request path, and ultimately writes the data to storage via buildStorage.Put. The router concatenates the path components without sanitizing them, producing a storage key. When this key is used, the underlying file system resolves the relative segments and writes the file to the specified path. Thus an attacker can craft a request that writes data to arbitrary locations on the server.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The esm.sh CDN (versions 137 and earlier) contains a path traversal vulnerability in its legacy router. The router builds storage keys by concatenating request path components without sanitization, and the underlying filesystem resolves relative path segments (e.g., '../'), allowing attackers to write data to arbitrary locations on the server.

MitigationUpgrade to a version beyond 137, which should include proper path sanitization. If immediate upgrade is not possible, implement input validation to strip or block relative path traversal sequences ('../') from incoming request paths before constructing storage keys.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify esm.sh installation
    Search for esm.sh related files, processes, or services in the environment. Check for packages named 'esm.sh', 'esm', or related directories in common installation locations (/node_modules, /usr/local/lib, etc.).
    Affected if esm.sh software is found running in the environment
  2. Determine if legacy router is enabled
    Examine the esm.sh configuration files (commonly config.json, config.yaml, or environment variables) for settings related to 'legacy', 'legacyRouter', or routing behavior. Check startup logs or command-line flags for legacy mode activation.
    Affected if The legacy router or legacy mode is explicitly enabled in the configuration
  3. Verify version against documented releases
    Check the installed esm.sh version by running version commands, examining package.json, or checking the binary/service version flag. Consult official esm.sh release documentation to compare against any fixed versions.
    Affected if The installed version has not yet received patches for path traversal vulnerability in the legacy router
  4. Inspect request path handling configuration
    Review configuration files that control how incoming request paths are processed before constructing storage keys. Look for settings governing path validation, sanitization, or canonicalization.
    Affected if No path validation, sanitization, or traversal sequence filtering is configured for incoming request paths
  5. Check storage directory boundaries
    Examine configuration for the storage root directory and verify whether any mechanism exists (chroot, containerization, mount restrictions) to prevent writes outside the intended directory.
    Affected if Storage keys are constructed without ensuring the final resolved path remains within an intended storage root directory

A user is affected if esm.sh with the legacy router enabled is running and the version lacks patches for path traversal, with no input validation configured on request paths before constructing storage keys.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade to a version beyond 137, which should include proper path sanitization. If immediate upgrade is not possible, implement input validation to strip or block relative path traversal sequences ('../') from incoming request paths before constructing storage keys.

Recommended fix Moderate confidence

version 138 or later

  1. 1. Identify the current esm.sh version running on the server
  2. 2. Upgrade to a version higher than 137 (e.g., version 138 or later)
  3. 3. Verify the upgrade completed successfully
  4. 4. Test that the path traversal vulnerability is no longer exploitable
  5. 5. Monitor for any anomalous file write attempts in server logs
Caveat review release notes for any breaking changes between your current version and the target version

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing4.0 h
  • Review / QA2.0 h
12.0 hours of engineering $2,080
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,328.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-44593 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-44593 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data