High [CVE-2026-73646] Information disclosure via path traversal in source map auto-loading
This high-severity Red Hat Linux advisory covers CVE-2026-73646 affecting Red Hat Hardened Images, Gatekeeper 3, Migration Toolkit for Containers.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute.map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable.map files through result.map.
This issue is fixed in version 8.5.18. A flaw was found in PostCSS.
An attacker can exploit a path traversal vulnerability by providing specially crafted `sourceMappingURL` values in untrusted CSS files. This allows the attacker to disclose sensitive `sourcesContent` from arbitrary `.map` files accessible on the system, leading to information disclosure.
Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22.
Affected products named by the advisory: Red Hat Hardened Images; Gatekeeper 3; Migration Toolkit for Containers; Node HealthCheck Operator; and 36 more.
Affected products named by the advisory: OpenShift Pipelines; OpenShift Service Mesh 3; Red Hat 3scale API Management Platform 2; Red Hat Advanced Cluster Management for Kubernetes 2; and 32 more.
- < 8.5.18
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
- 8.5.18
- prometheus3-13-main-3.13.2-0.2.hum1
- prometheus3-5-main-3.5.5-0.8.hum1
- RHSA-2026:50287
- RHSA-2026:54520
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation
Upgrade to a fixed release: 8.5.18, prometheus3-13-main-3.13.2-0.2.hum1, prometheus3-5-main-3.5.5-0.8.hum1, RHSA-2026:50287, RHSA-2026:54520. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.