GitHub Advisoryadvisory · npm

GHSA-935g-9rq5-q95c short-video-maker has a path traversal vulnerability

MEDIUM Published 2026-05-08 Modified 2026-05-13 Official page ↗
Aliases
CVE-2026-8115
Ecosystem
npm
Packages
short-video-maker
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2026-05-13

Affected packages

• npm short-video-maker: <= 1.3.4 (no fix yet)

Description

A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the file src/server/routers/rest.ts of the component REST API. The manipulation of the argument req.params.tmpFile results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Related

Alias · CVE (1)

  • CVE-2026-8115 A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References