This vulnerability (CVE-2026-69153) in PostCSS arises from improper handling of the sourceMappingURL when the 'from' parameter is unset, leading to a path traversal that exposes source-map files (.map) containing source code paths and content. The issue affects Red Hat Hardened Images RPMs, including prometheus3.5 versions before 3.5.5-0.7.hum1. Red Hat classifies the impact as Moderate because the attacker cannot read arbitrary files beyond source maps. Exploitation requires the application to process attacker-controlled CSS on the server side. The recommended mitigation is to disable source map auto-loading by passing map: false to PostCSS, which prevents the vulnerability but disables source map support. No official patch is currently provided for the affected Red Hat Hardened Images RPMs, and users should refer to Red Hat advisories for updates.

The vulnerability allows an attacker to read unintended source-map files (.map) via a crafted sourceMappingURL, potentially exposing sensitive information about the application's source code. However, the attacker cannot read arbitrary files on the system. The impact is limited to confidentiality exposure of source map contents. There is no impact on integrity or availability. Exploitation requires server-side processing of attacker-controlled CSS through PostCSS.

Red Hat advises disabling source map auto-loading by passing map: false when invoking PostCSS to prevent the path traversal vulnerability. This mitigation removes source map support entirely but effectively blocks exploitation. No official fix or patch is currently available for the affected Red Hat Hardened Images RPMs. Users should monitor Red Hat advisories for updates and apply mitigations as appropriate.