@hapi/inert is a static file and directory handler for hapi.js. Between versions 4.0.0 and 7.1.0, the module enforces directory confinement by comparing the resolved absolute path against the configured confine directory using a raw string-prefix test. This method is flawed because it incorrectly accepts sibling directories (e.g., /app/static-secret when confine is /app/static), enabling path traversal attacks. An attacker can exploit this to read unauthorized files by using encoded path traversal sequences such as /..%2fstatic-secret/secret.txt. The vulnerability is tracked as CVE-2026-48049 and is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The issue is resolved in version 7.1.1.

An unauthenticated remote attacker can read arbitrary files outside the intended static file directory by exploiting the path traversal vulnerability. This leads to unauthorized disclosure of potentially sensitive information. There is no indication of impact on integrity or availability.

Upgrade @hapi/inert to version 7.1.1 or later, where the path traversal vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade from the vendor's official release notes or repository. Until upgraded, avoid exposing static file directories that may contain sensitive data or implement additional access controls outside of @hapi/inert.