alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"VEDAS CVE-2026-109823 Tidewave for Phoenix - Unauthenticated Project Path Disclosure"; flow:established,to_client; http.response_body; content:"\"tidewave_version\""; nocase; fast_pattern; content:"\"framework_type\""; nocase; content:"\"tmp_dir\""; nocase; content:"phoenix"; nocase; classtype:successful-recon-limited; reference:cve,CVE-2026-109823; reference:url,https://www.exploit.observer/?keyword=CVE-2026-109823&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=tidewave&match=exact; sid:1089400; rev:1;)