{"affected":[{"defaultStatus":"unaffected","ecosystem":"hex","packageName":"tidewave","product":"tidewave","source":"CNA: EEF","vendor":"tidewave-ai","versions":[{"lessThan":"0.9.2","status":"affected","version":"0.8.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"tidewave-ai/tidewave_phoenix","product":"tidewave","source":"CNA: EEF","vendor":"tidewave-ai","versions":[{"lessThan":"80159536f752dc4d34797934d1516f29cea12b50","status":"affected","version":"f78352b56d19cd4ae49999aa385011cef73e8b93","versionType":"git"}]}],"cveId":"CVE-2026-109823","cwes":["CWE-497"],"description":"An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.\n\nNeither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout.\n\nThis issue affects tidewave: from 0.8.0 before 0.9.2.","epss":{"date":"2026-11-04","percentile":0.30778,"score":0.00368},"exploits":[],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793824045043,"publishedAt":1793116056862,"references":[{"source":"CNA: EEF","tags":["related","third-party-advisory"],"url":"https://cna.erlef.org/cves/CVE-2026-109823.html"},{"source":"CNA: EEF","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-109823"},{"source":"CNA: EEF","tags":["related"],"url":"https://github.com/tidewave-ai/tidewave_phoenix/commit/f78352b56d19cd4ae49999aa385011cef73e8b93"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/tidewave-ai/tidewave_phoenix/commit/80159536f752dc4d34797934d1516f29cea12b50"}],"remediation":[{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/tidewave-ai/tidewave_phoenix/commit/80159536f752dc4d34797934d1516f29cea12b50"}],"revision":"9b209e28e3355e61110775fdda6a74bd1d240cbaaaba06f308a154753c2d15f9","sources":[{"modifiedAt":1793824045043,"name":"CNA: EEF","retrievedAt":1793826565272,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109823"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793826588508,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109823"}],"ssvc":{"assessedAt":1793817769882,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Host filesystem path disclosure via DNS rebinding","updatedAt":1793826588508}