cve-2026-7120

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7120.json"
      }
    ],
    "title": "@fastify/static: @fastify/static: Information disclosure via improper path normalization",
    "tracking": {
      "current_release_date": "2026-11-04T12:51:09+00:00",
      "generator": {
        "date": "2026-11-04T12:51:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "CVE-2026-7120",
      "initial_release_date": "2026-07-23T02:48:35.120000+00:00",
      "revision_history": [
        {
          "date": "2026-07-23T02:48:35.120000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-04T11:11:13+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-11-04T12:51:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AI (RHEL AI) 3",
                "product": {
                  "name": "Red Hat Enterprise Linux AI (RHEL AI) 3",
                  "product_id": "red_hat_enterprise_linux_ai_(rhel_ai)_3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux_ai:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux AI (RHEL AI) 3"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift AI (RHOAI)",
                "product": {
                  "name": "Red Hat OpenShift AI (RHOAI)",
                  "product_id": "red_hat_openshift_ai_(rhoai)",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_ai"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift AI (RHOAI)"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Dev Spaces",
                "product": {
                  "name": "Red Hat OpenShift Dev Spaces",
                  "product_id": "red_hat_openshift_dev_spaces",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_devspaces:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Dev Spaces"
          },
          {
            "category": "product_version",
            "name": "rhelai3/bootc-cuda-rhel9",
            "product": {
              "name": "rhelai3/bootc-cuda-rhel9",
              "product_id": "rhelai3/bootc-cuda-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/bootc-cuda-rhel9@sha256:e0fbb896811ab54d183e23612030072b946674824bad697bf2b3f68362651662?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhelai3/bootc-gaudi-rhel9",
            "product": {
              "name": "rhelai3/bootc-gaudi-rhel9",
              "product_id": "rhelai3/bootc-gaudi-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhelai3/bootc-rocm-rhel9",
            "product": {
              "name": "rhelai3/bootc-rocm-rhel9",
              "product_id": "rhelai3/bootc-rocm-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/bootc-rocm-rhel9@sha256:8fe5203e86917e5f829bd64b831cad31536d23a213b4bfe31e652577ad0faf2e?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhelai3/disk-image-cuda-rhel9",
            "product": {
              "name": "rhelai3/disk-image-cuda-rhel9",
              "product_id": "rhelai3/disk-image-cuda-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/disk-image-cuda-rhel9@sha256:9d807c5381e81734b6303669421b265aea1eca54a18ca577d453508ffde1770c?repository_url=registry.redhat.io/rhelai3/disk-image-cuda-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-core-bff-rhel9",
            "product": {
              "name": "rhoai/odh-core-bff-rhel9",
              "product_id": "rhoai/odh-core-bff-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-core-bff-rhel9@sha256:de9f7a1bbf0734f894843e0c7955ba0d3f35334d3afee9229102e0b02ad663ef?repository_url=registry.redhat.io/rhoai/odh-core-bff-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-dashboard-operator-rhel9",
            "product": {
              "name": "rhoai/odh-dashboard-operator-rhel9",
              "product_id": "rhoai/odh-dashboard-operator-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-dashboard-operator-rhel9@sha256:d0ff5e12c326f1c8bf6b7fa8ac501871ffe346c14cd35160fde4572137a25b8c?repository_url=registry.redhat.io/rhoai/odh-dashboard-operator-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-dashboard-rhel9",
            "product": {
              "name": "rhoai/odh-dashboard-rhel9",
              "product_id": "rhoai/odh-dashboard-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-dashboard-rhel9@sha256:ccfd60d1c87385181f541ad46fc53a6f7b71e4447c766434fa420775189f5405?repository_url=registry.redhat.io/rhoai/odh-dashboard-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-mod-arch-agent-ops-rhel9",
            "product": {
              "name": "rhoai/odh-mod-arch-agent-ops-rhel9",
              "product_id": "rhoai/odh-mod-arch-agent-ops-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-mod-arch-agent-ops-rhel9@sha256:46b444a7fc955ca339c4b3c6c5f9474ef7c5cea617ab8214ce8e27a29b5b85c4?repository_url=registry.redhat.io/rhoai/odh-mod-arch-agent-ops-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-mod-arch-automl-rhel9",
            "product": {
              "name": "rhoai/odh-mod-arch-automl-rhel9",
              "product_id": "rhoai/odh-mod-arch-automl-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-mod-arch-automl-rhel9@sha256:93239529dd6854c6b03a9ded073fa6d1f07eb7377b56bf466669ab539919e48d?repository_url=registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-mod-arch-autorag-rhel9",
            "product": {
              "name": "rhoai/odh-mod-arch-autorag-rhel9",
              "product_id": "rhoai/odh-mod-arch-autorag-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-mod-arch-autorag-rhel9@sha256:de36d69097a2f9cd6125a983943aa1218278d06e79ce030ceab1b092cc7510a6?repository_url=registry.redhat.io/rhoai/odh-mod-arch-autorag-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-mod-arch-eval-hub-rhel9",
            "product": {
              "name": "rhoai/odh-mod-arch-eval-hub-rhel9",
              "product_id": "rhoai/odh-mod-arch-eval-hub-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-mod-arch-eval-hub-rhel9@sha256:342ab0dbd96bac15f0ff048b8b1ae6e5ac3840628b0f2ee35ece8289a9d91d8b?repository_url=registry.redhat.io/rhoai/odh-mod-arch-eval-hub-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-mod-arch-gen-ai-rhel9",
            "product": {
              "name": "rhoai/odh-mod-arch-gen-ai-rhel9",
              "product_id": "rhoai/odh-mod-arch-gen-ai-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-mod-arch-gen-ai-rhel9@sha256:b12d8247d21c8c862e5f4824145e4a6ac90ab73ce149d5ef7b1eb1d1f34b9def?repository_url=registry.redhat.io/rhoai/odh-mod-arch-gen-ai-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-mod-arch-maas-rhel9",
            "product": {
              "name": "rhoai/odh-mod-arch-maas-rhel9",
              "product_id": "rhoai/odh-mod-arch-maas-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-mod-arch-maas-rhel9@sha256:34954fc242ca5a0d736d90f8cba4d4383f41058a966717cfdc25d378cf92c064?repository_url=registry.redhat.io/rhoai/odh-mod-arch-maas-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-mod-arch-mlflow-rhel9",
            "product": {
              "name": "rhoai/odh-mod-arch-mlflow-rhel9",
              "product_id": "rhoai/odh-mod-arch-mlflow-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-mod-arch-mlflow-rhel9@sha256:53674c7c6aa3d0e35160f4297fe15411230ebbd6d67092c8b4905e898b98e5ec?repository_url=registry.redhat.io/rhoai/odh-mod-arch-mlflow-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhoai/odh-mod-arch-model-registry-rhel9",
            "product": {
              "name": "rhoai/odh-mod-arch-model-registry-rhel9",
              "product_id": "rhoai/odh-mod-arch-model-registry-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odh-mod-arch-model-registry-rhel9@sha256:313ee76c23d73fd3d01161db765e539a5cc20769dd04ef3047057ff78f10450c?repository_url=registry.redhat.io/rhoai/odh-mod-arch-model-registry-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "devspaces/dashboard-rhel9",
            "product": {
              "name": "devspaces/dashboard-rhel9",
              "product_id": "devspaces/dashboard-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/dashboard-rhel9@sha256:4da408d8b9dd1368285e5f289dd89ab2f86f069e50d88b1241e997b88edbf7ed?repository_url=registry.redhat.io/devspaces/dashboard-rhel9"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3",
          "product_id": "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9"
        },
        "product_reference": "rhelai3/bootc-cuda-rhel9",
        "relates_to_product_reference": "red_hat_enterprise_linux_ai_(rhel_ai)_3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3",
          "product_id": "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9"
        },
        "product_reference": "rhelai3/bootc-gaudi-rhel9",
        "relates_to_product_reference": "red_hat_enterprise_linux_ai_(rhel_ai)_3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3",
          "product_id": "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9"
        },
        "product_reference": "rhelai3/bootc-rocm-rhel9",
        "relates_to_product_reference": "red_hat_enterprise_linux_ai_(rhel_ai)_3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhelai3/disk-image-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3",
          "product_id": "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9"
        },
        "product_reference": "rhelai3/disk-image-cuda-rhel9",
        "relates_to_product_reference": "red_hat_enterprise_linux_ai_(rhel_ai)_3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-core-bff-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-core-bff-rhel9"
        },
        "product_reference": "rhoai/odh-core-bff-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-dashboard-operator-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-operator-rhel9"
        },
        "product_reference": "rhoai/odh-dashboard-operator-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-dashboard-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-rhel9"
        },
        "product_reference": "rhoai/odh-dashboard-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-mod-arch-agent-ops-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-agent-ops-rhel9"
        },
        "product_reference": "rhoai/odh-mod-arch-agent-ops-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-mod-arch-automl-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-automl-rhel9"
        },
        "product_reference": "rhoai/odh-mod-arch-automl-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-mod-arch-autorag-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-autorag-rhel9"
        },
        "product_reference": "rhoai/odh-mod-arch-autorag-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-mod-arch-eval-hub-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-eval-hub-rhel9"
        },
        "product_reference": "rhoai/odh-mod-arch-eval-hub-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-mod-arch-gen-ai-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-gen-ai-rhel9"
        },
        "product_reference": "rhoai/odh-mod-arch-gen-ai-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-mod-arch-maas-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-maas-rhel9"
        },
        "product_reference": "rhoai/odh-mod-arch-maas-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-mod-arch-mlflow-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-mlflow-rhel9"
        },
        "product_reference": "rhoai/odh-mod-arch-mlflow-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhoai/odh-mod-arch-model-registry-rhel9 as a component of Red Hat OpenShift AI (RHOAI)",
          "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-model-registry-rhel9"
        },
        "product_reference": "rhoai/odh-mod-arch-model-registry-rhel9",
        "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devspaces/dashboard-rhel9 as a component of Red Hat OpenShift Dev Spaces",
          "product_id": "red_hat_openshift_dev_spaces:devspaces/dashboard-rhel9"
        },
        "product_reference": "devspaces/dashboard-rhel9",
        "relates_to_product_reference": "red_hat_openshift_dev_spaces"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-7120",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "discovery_date": "2026-07-23T04:00:43.261794+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_openshift_ai_(rhoai):rhoai/odh-core-bff-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-operator-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-agent-ops-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-automl-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-autorag-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-eval-hub-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-gen-ai-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-maas-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-mlflow-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-model-registry-rhel9"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506344"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in @fastify/static. An unauthenticated attacker can bypass path restrictions by sending specially crafted requests that include non-canonical pathnames. This vulnerability occurs because the allowedPath callback is evaluated before the path is fully normalized, allowing an attacker to access files that should have been denied by security filters. The primary impact is information disclosure, as it can lead to the unintended serving of restricted files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "@fastify/static: @fastify/static: Information disclosure via improper path normalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has classified this vulnerability as having a Moderate severity because exploitation is contingent on an application explicitly defining an allowedPath callback for authorization, and the impact is confined to files within the configured static root directory. An attacker cannot leverage this issue to achieve path traversal outside the designated web root or access arbitrary files on the host system. Consequently, services that do not employ static path-filtering callbacks or that do not host confidential data within the static asset tree are not at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9",
          "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9",
          "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9",
          "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9",
          "red_hat_openshift_dev_spaces:devspaces/dashboard-rhel9"
        ],
        "known_not_affected": [
          "red_hat_openshift_ai_(rhoai):rhoai/odh-core-bff-rhel9",
          "red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-operator-rhel9",
          "red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-rhel9",
          "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-agent-ops-rhel9",
          "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-automl-rhel9",
          "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-autorag-rhel9",
          "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-eval-hub-rhel9",
          "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-gen-ai-rhel9",
          "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-maas-rhel9",
          "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-mlflow-rhel9",
          "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-model-registry-rhel9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-7120"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506344",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506344"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-7120",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-7120"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-7120",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7120"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj",
          "url": "https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj"
        }
      ],
      "release_date": "2026-07-23T02:48:35.120000+00:00",
      "remediations": [
        {
          "category": "none_available",
          "details": "Fix deferred",
          "product_ids": [
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9",
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9",
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9",
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9",
            "red_hat_openshift_dev_spaces:devspaces/dashboard-rhel9"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9",
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9",
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9",
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-core-bff-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-operator-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-agent-ops-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-automl-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-autorag-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-eval-hub-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-gen-ai-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-maas-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-mlflow-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-model-registry-rhel9",
            "red_hat_openshift_dev_spaces:devspaces/dashboard-rhel9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9",
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9",
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9",
            "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-core-bff-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-operator-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-agent-ops-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-automl-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-autorag-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-eval-hub-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-gen-ai-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-maas-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-mlflow-rhel9",
            "red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-model-registry-rhel9",
            "red_hat_openshift_dev_spaces:devspaces/dashboard-rhel9"
          ]
        }
      ],
      "title": "@fastify/static: @fastify/static: Information disclosure via improper path normalization"
    }
  ]
}