CVE-2026-106108: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in quasarframework quasar

The vulnerability arises because the getSsgPages() function in @quasar/app-vite returns page definitions with dir and filename values that are joined to the build.distDir path without verifying that the final resolved path remains within the intended directory. This improper limitation of pathname allows parent directory traversal or symlink exploitation to write files outside the designated output directory during the build process. Since application configuration and SSG page definitions are trusted by default, exploitation requires the build to incorporate external or less-trusted content. The renderer's no-overwrite behavior protects existing files, limiting some impact. The vulnerability affects Quasar Framework versions >=2.22.0 <2.23.3 and >=3.1.0 <3.3.0 and is resolved in 3.3.0.

An attacker who can influence the build process with external or less-trusted content may cause the build to write new HTML files or directories outside the intended distribution directory. These files are created with the build user's permissions. Existing files are protected from overwrite by the renderer. This could lead to unauthorized file creation outside the expected output tree, potentially impacting system integrity depending on the build environment and permissions.

Upgrade to Quasar Framework version 3.3.0 or later, where this vulnerability is fixed. Since this is a build-time vulnerability, ensure that all inputs to the build process, especially application configuration and SSG page definitions, are from trusted sources. No other vendor advisory or patch links are provided, so check the official Quasar Framework release notes for confirmation.