CVE-2026-106108.

Disclosure summary

## Summary During an SSG build, page definitions returned by `getSsgPages()` can provide custom `dir` and `filename` values. The builder joined those values to `build.distDir` and wrote the generated page without verifying that the final destination remained inside the distribution directory. ## Details A page definition containing parent-directory traversal could cause the build to create a new HTML file outside `build.distDir`. An existing symlink below the distribution directory could also redirect a generated file or newly created directories outside the output tree. Quasar application configuration and SSG page definitions are trusted input by default, so this is not normally a remote file-write primitive. The issue becomes relevant when an application derives SSG page definitions from external or otherwise untrusted content, or when build configuration is compromised. Existing files are protected by the SSG renderer's no-overwrite behavior, but new files and directories can be created with the permissions of the build user. ## Impact An attacker able to influence an application's SSG page definitions could create files outside the intended build output directory during `quasa

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

Original records & references

• NIST NVD record
• CVE Program record
• github.com — Reviewed advisory

PUBLISHED 2026-10-07T12:14:41-04:00
MODIFIED 2026-10-07T12:14:42-04:00
INGESTED 2026-10-08T12:05:11-04:00