CVE-2026-49144 is a path traversal vulnerability in browserstack-runner up to version 0.9.5. The flaw exists in the _default HTTP handler in lib/server.js, which improperly restricts pathname access. An unauthenticated attacker on the network can exploit the HTTP server, which listens on all interfaces, to traverse directories outside the intended project root and read arbitrary files. This can lead to unauthorized disclosure of sensitive information. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity, with attack vector being adjacent network, low attack complexity, and no privileges or user interaction required. No official patch or remediation level is currently stated in the available data.

An unauthenticated attacker on the network adjacent to the vulnerable system can read arbitrary files outside the intended directory by exploiting the path traversal vulnerability in the HTTP server. This can lead to unauthorized disclosure of sensitive files, potentially compromising confidentiality. There is no indication of privilege escalation, integrity, or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the HTTP server to trusted hosts only and monitor for unusual file access attempts. Avoid exposing the vulnerable HTTP server to untrusted networks.