Description
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.
Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout.
This issue affects tidewave: from 0.8.0 before 0.9.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tidewave-ai | tidewave | 0.8.0 – < 0.9.2 | 0.9.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hex | tidewave | >= 0.8.0, < 0.9.2 | 0.9.2 | EEF-CVE-2026-109823 |
References
- EEF CNA record for CVE-2026-109823 related third-party-advisory
- OSV record EEF-CVE-2026-109823 related
- Introducing commit f78352b in tidewave-ai/tidewave_phoenix related
- Fix commit 8015953 in tidewave-ai/tidewave_phoenix patch