GitHub Advisoryadvisory · npm

GHSA-2mp5-m968-gwr2 Path Traversal in http-file-server

MEDIUM Published 2019-07-16 Modified 2023-02-03 Official page ↗
Aliases
CVE-2019-5447
Ecosystem
npm
Packages
http-file-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2019-07-15

Affected packages

• npm http-file-server: < 0.2.6 (no fix yet)

Description

All versions of `http-file-server` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2019-5447 A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References