GitHub Advisoryadvisory · npm

GHSA-m8cr-q935-8j67 Path Traversal in buttle

HIGH Published 2018-09-18 Modified 2023-03-01 Official page ↗
Aliases
CVE-2018-3766
Ecosystem
npm
Packages
buttle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm buttle: <= 0.2.0 (no fix yet)

Description

All versions of `buttle` are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths when fetching files. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2018-3766 Path traversal in buttle module versions <= 0.2.0 allows to read any file in the server. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References