GHSA-3hjh-5hgx-f5wh

Path traversal vulnerability in glance

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25937

Packages

Ecosystem	Package	Affected	Fixed in
npm	glance	< 3.0.9	3.0.9

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-25937 advisory
https://github.com/jarofghosts/glance/commit/8cecfe90286e0c45a5494067f1b592d0ccfeabac web
https://gist.github.com/lirantal/c8cfb0398c78e558b7d4ac02aae67809 web
https://github.com/jarofghosts/glance package
https://security.snyk.io/vuln/SNYK-JS-GLANCE-3318395 web