A high severity path traversal vulnerability in Logto could allow unauthorized access to sensitive data, necessitating an immediate update.

The software suffers from an improper limitation of a pathname to a restricted directory (CWE-22), which allows unauthenticated remote attackers to perform path traversal and access unauthorized filesystem areas.

This vulnerability poses a severe risk of information disclosure, as attackers could potentially read sensitive configuration files or credentials stored within the server environment. With a CVSS score of 8.7, the exposure of auth infrastructure data could facilitate further attacks against the entire SaaS or AI application ecosystem.

Immediate Action: Update the @logto/tunnel package to version 0.3.9 or later to remediate the path traversal flaw.

Proactive Monitoring: Review web server and application logs for directory traversal patterns, such as sequences involving dots and slashes in unexpected request parameters.

Compensating Controls: Configure Web Application Firewalls to block requests containing directory traversal sequences or attempts to access sensitive system paths.

Public Exploit Available: Unknown

Given the critical nature of authentication infrastructure, this vulnerability must be addressed urgently. Security teams should verify the version of the @logto/tunnel component in their deployments and apply the provided update as soon as possible to prevent unauthorized data access.