CVE-2026-63188: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in logto-io logto

The logto Tunnel npm package versions before 0.3.9 use path.join to combine a static directory path with user-controlled request URLs without normalizing or verifying containment. When the --experience-path option is enabled and the tunnel port is accessible, an unauthenticated attacker can exploit this by including '../' sequences in the request URL to access files outside the designated static directory. The server listens on a port that may be reachable by other hosts depending on deployment, increasing exposure. This path traversal vulnerability is addressed in version 0.3.9.

An unauthenticated attacker can read arbitrary files on the server that are accessible to the logto-tunnel process, potentially exposing sensitive information. The vulnerability does not require authentication and can be exploited remotely if the tunnel port is reachable. This could lead to information disclosure impacting confidentiality.

Upgrade to logto version 0.3.9 or later, where this path traversal vulnerability is fixed. No other mitigations are indicated by the vendor advisory.