GitHub Advisoryadvisory · npm

GHSA-6495-8jvh-f28x File restriction bypass in socket.io-file

HIGH Published 2020-10-02 Modified 2026-01-22 Official page ↗
Aliases
CVE-2020-24807
Ecosystem
npm
Packages
socket.io-file
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2020-10-02

Affected packages

• npm socket.io-file: <= 2.0.31 (no fix yet)

Description

All versions of `socket.io-file`are vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the `name` value to upload any file types. No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2020-24807 The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References