Homepage

Directory Traversal The advisory has been revoked - it doesn't affect any version of package automation-gateway  (opens in a new tab)

Threat Intelligence

EPSS
0.52% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-AUTOMATIONGATEWAY-16449685
  • published7 May 2026
  • disclosed4 May 2026
Report a new vulnerability Found a mistake?

Introduced: 4 May 2026

CVE-2026-6321  (opens in a new tab)
CWE-22  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream automation-gateway package and not the automation-gateway package as distributed by RHEL.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

References