GitHub Advisoryadvisory · npm

GHSA-xwg4-93c6-3h42 Directory Traversal in send

LOW Published 2017-10-24 Modified 2021-09-22 Official page ↗
Aliases
CVE-2014-6394
Ecosystem
npm
Packages
send
Severity
Low
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm send: < 0.8.4 → fixed in 0.8.4

Description

Versions 0.8.3 and earlier of `send` are affected by a directory traversal vulnerability. When relying on the root option to restrict file access it may be possible for an application consumer to escape out of the restricted directory and access files in a similarly named directory. For example, `static(_dirname + '/public')` would allow access to `_dirname + '/public-restricted'`. Recommendation Update to version 0.8.4 or later.

Related

Alias · CVE (1)

  • CVE-2014-6394 visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References