GitHub Advisoryadvisory · npm

GHSA-4vvp-x9h2-x2vf Path Traversal in public

MEDIUM Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
public
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2020-08-31

Affected packages

• npm public: >= 0.0.0 (no fix yet)

Description

All versions of `public` are vulnerable to Path Traversal. This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL. Recommendation No fix is currently available. Do not use `public` in production or consider using an alternative module until a fix is made available.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References