GitHub Advisoryadvisory · npm

GHSA-m273-wwfv-h6jp Directory Traversal in fancy-server

HIGH Published 2020-08-31 Modified 2020-08-31 Official page ↗
Aliases
CVE-2014-10066
Ecosystem
npm
Packages
fancy-server
Severity
High
Weaknesses
CWE-22
Reviewed
2020-08-31

Affected packages

• npm fancy-server: < 0.1.4 → fixed in 0.1.4

Description

Versions 0.1.4 and earlier of fancy-server are vulnerable to a directory traversal attack. Standard attack vectors such as `../` will allow an attacker to read files outside of the served directory. Recommendation Upgrade to version 0.1.4 or greater.

Related

Alias · CVE (1)

  • CVE-2014-10066 Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References