GitHub Advisoryadvisory · npm

GHSA-wfhx-6pcm-7m55 Path Traversal in ponse

HIGH Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
ponse
Severity
High
Weaknesses
CWE-22
Reviewed
2020-08-31

Affected packages

• npm ponse: < 2.0.2 → fixed in 2.0.2

Description

Versions of `ponse` prior to 2.0.2 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 2.0.2 or later.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References