CVE-2026-73646 is a path traversal vulnerability in PostCSS that can be exploited by supplying malicious sourceMappingURL values in CSS files. This leads to unauthorized disclosure of sensitive source map files (.map) on the system. The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Red Hat Lightspeed in Satellite uses PostCSS and is affected by this issue. The advisory provides a new container image for satellite/iop-host-inventory-frontend-rhel9 but does not mention a patch or fix for this vulnerability. Red Hat scores this vulnerability as high severity with a CVSS v3 base score of 7.5, reflecting network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact.

An attacker can exploit this vulnerability to read arbitrary .map files on the system, potentially disclosing sensitive source code or configuration data. This information disclosure can aid further attacks or reconnaissance. The vulnerability does not impact integrity or availability directly but compromises confidentiality. No known exploits in the wild have been reported. The vulnerability affects Red Hat Satellite components that include PostCSS, specifically the Red Hat Lightspeed feature.

The vendor advisory does not indicate that a fix or patch is currently available for this vulnerability. Users should monitor Red Hat's official advisories and update to fixed versions once released. The advisory provides a new container image for satellite/iop-host-inventory-frontend-rhel9 but does not state it addresses this vulnerability. No specific mitigations or workarounds are provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.