GitHub Advisoryadvisory · npm

GHSA-j27j-4w6m-8fc4 Path Traversal in statics-server

MEDIUM Published 2020-03-31 Modified 2020-08-31 Official page ↗
Aliases
CVE-2019-15596
Ecosystem
npm
Packages
statics-server
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2020-03-31

Affected packages

• npm statics-server: <= 0.0.9 (no fix yet)

Description

All versions of `statics-server` are vulnerable to Path Traversal. The package fails to limit access to files outside of the served folder through symlinks. Recommendation No fix is currently available. Do not use `statics-server` in production or consider using an alternative module until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2019-15596 A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References