GitHub Advisoryadvisory · npm

GHSA-3hjh-5hgx-f5wh Path traversal vulnerability in glance

MEDIUM Published 2023-02-13 Modified 2025-03-21 Official page ↗
Aliases
CVE-2022-25937
Ecosystem
npm
Packages
glance
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-02-14

Affected packages

• npm glance: < 3.0.9 → fixed in 3.0.9

Description

Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in CVE-2018-3715.

Related

Alias · CVE (1)

  • CVE-2022-25937 Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References