The @logto/tunnel CLI tool has a path traversal vulnerability (CVE-2026-63188) that allows an unauthenticated remote attacker to read arbitrary files outside the configured custom sign-in experience directory. This occurs because the tunnel serves static files from a specified directory but does not properly validate or normalize request paths, allowing '../' sequences to escape the intended directory. The vulnerability affects versions prior to 0.3.9 and has a high severity CVSS score of 8.7.