Description

In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

Remediation

References

https://github.com/whitesource/CureKit/commit/af35e870ed09411d2f1fae6db1b04598cd1a31b6

https://www.mend.io/vulnerability-database/CVE-2022-23082

Related Vulnerabilities

CVE-2020-7662 Vulnerability in npm package websocket-extensions

CVE-2023-24807 Vulnerability in maven package org.webjars.npm:undici

CVE-2022-21122 Vulnerability in npm package metacalc

CVE-2020-7680 Vulnerability in npm package docsify

CVE-2021-23820 Vulnerability in npm package json-pointer

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Third Party Advisory Vendor Advisory