GitHub Advisoryadvisory · npm

GHSA-v588-qcp3-jv46 Path Traversal in serve

HIGH Published 2019-03-25 Modified 2025-07-15 Official page ↗
Aliases
CVE-2019-5415
Ecosystem
npm
Packages
serve
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-548
Reviewed
2020-06-16

Affected packages

• npm serve: < 7.0.0 → fixed in 7.0.0

Description

Versions of `serve` prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a `/./`, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 7.0.1 or later.

Related

Alias · CVE (1)

  • CVE-2019-5415 A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the… vulnerability

Weakness · CWE (1)

  • CWE-548 Exposure of Information Through Directory Listing weakness

References