CVE-2026-106109: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in quasarframework quasar

The vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22) in the Quasar Framework's build tool @quasar/app-vite. Specifically, from versions 1.0.0 until 3.3.0, the tool recursively deletes the resolved build.distDir directory before starting the build process without rejecting critical directories such as the project root, user home directory, filesystem roots, or symlink-resolved external directories. Because no attacker-controlled input reaches build.distDir by default, exploitation requires that a compromised or less-trusted automation influences the build configuration or a developer runs a mistaken configuration. This can result in deletion of important data writable by the build user prior to compilation. The vulnerability is addressed in version 3.3.0.

If exploited, this vulnerability can cause deletion of data writable by the build user before compilation begins. However, exploitation is limited because no attacker-controlled input reaches the build.distDir by default. Therefore, the risk arises mainly in environments where build configurations can be influenced by compromised or less-trusted automation or by developer error. The CVSS 4.0 base score is 4.1 (medium severity), reflecting local attack vector, high attack complexity, and partial privileges required.

Upgrade to Quasar Framework version 3.3.0 or later, where this issue is fixed. Until then, ensure that build configurations are not influenced by untrusted automation or users, and avoid running builds with unsafe or mistaken configurations that could cause deletion of critical directories. There is no indication of a vendor advisory or patch beyond the fixed version, so checking the official Quasar Framework release notes for confirmation is recommended.