Home / Vulnerability Intelligence / CVE-2026-40931

CVE-2026-40931 - Vulnerability Analysis

HighCVSS: 8.4

Last Updated: April 21, 2026

Compressing - Path Traversal

Published: April 21, 2026Updated: April 21, 2026

Overview

Compressing < 2.1.1 and < 1.10.5 contains a path traversal caused by logical string validation bypass in isPathWithinParent utility, letting attackers bypass security checks via directory poisoning with symbolic links, exploit requires pre-existing symlinks.

Severity & Score

Severity: High

CVSS Score: 8.4

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Attackers can bypass directory traversal protections to access or modify unauthorized files.

Mitigation

Update to version 2.1.1 or 1.10.5 or later.

References

https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Apr 21, 2026

🟠 CVE-2026-40931 - High (8.4) Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40931/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Apr 21, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-40931
Severity: High
CVSS Score: 8.4
Type: path_traversal
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-59

CVSS Metrics

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days