GitHub Advisoryadvisory · npm

GHSA-48gc-5j93-5cfq Path Traversal in serve

HIGH Published 2020-09-11 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
serve
Severity
High
Weaknesses
CWE-22
Reviewed
2020-08-31

Affected packages

• npm serve: < 10.1.2 → fixed in 10.1.2

Description

Versions of `serve` prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 10.1.2 or later.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References