Description

Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.

Remediation

References

https://nodesecurity.io/advisories/9

Related Vulnerabilities

CVE-2018-6333 Vulnerability in npm package nuclide

CVE-2021-29469 Vulnerability in npm package redis

CVE-2017-2608 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2022-37258 Vulnerability in npm package steal

CVE-2021-23562 Vulnerability in npm package plupload

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory