Medium 4.4Published Sep 16, 2026

CVE-2026-63225Redocly CLI: Path traversal when using `split` command

Updated under an hour ago (Oct 28, 2026, 3:50 PM ET)

Does this affect you?

It affects redocly-cli. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for redocly-cli

Exploited in the last 30 days

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target remains inside the selected directory. A description containing literal ../ traversal segments in those fields can cause the split command to place or overwrite files outside --outDir. Component data remains constrained to YAML or JSON, and code-sample filenames remain based on the HTTP method, so this is not an unrestricted arbitrary-content file write. This issue is fixed in @redocly/cli version 2.33.2.

CVSS: 4.4 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness (CWE): CWE-22, CWE-73
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Awaiting Analysis
Record last updated: Sep 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Redocly redocly-cli redocly:cli (from the name)	before 1.34.17; from 2.0.0, < 2.33.2	CNA record

References

References

https://github.com/Redocly/redocly-cli/security/advisories/GHSA-657c-g7qc-r9j2	x-refsource-confirm
https://github.com/Redocly/redocly-cli/pull/2891	x-refsource-misc
https://github.com/Redocly/redocly-cli/pull/2923	x-refsource-misc
https://github.com/Redocly/redocly-cli/commit/26a0f299fae0b3bb7bd513043d2f1e90e69f79ee	x-refsource-misc
https://github.com/Redocly/redocly-cli/commit/504120419a72b5c684471478337ee3b45d8bfad3	x-refsource-misc
https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@1.34.17	x-refsource-misc
https://github.com/Redocly/redocly-cli/releases/tag/@redocly/cli@2.33.2	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.