GitHub Advisoryadvisory · npm

GHSA-vfp9-gwrh-wq9g Path Traversal in crud-file-server

HIGH Published 2018-07-18 Modified 2023-03-01 Official page ↗
Aliases
CVE-2018-3733
Ecosystem
npm
Packages
crud-file-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm crud-file-server: < 0.9.0 → fixed in 0.9.0

Description

Versions of `crud-file-server` prior to 0.9.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 0.9.0 or later.

Related

Alias · CVE (1)

  • CVE-2018-3733 crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References