GHSA-45j8-pm75-5v8x

Path Traversal in simplehttpserver

Source: GitHub Advisory Database (reviewed) High CVE-2018-16493

Packages

Ecosystem	Package	Affected	Fixed in
npm	static-resource-server	<= 1.7.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `simplehttpserver` prior to 0.2.1 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. ## Recommendation Upgrade to version 0.2.1 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-16493 advisory
https://hackerone.com/reports/357109 web
https://hackerone.com/reports/432600 web
https://github.com/advisories/GHSA-45j8-pm75-5v8x advisory
https://www.npmjs.com/advisories/967 web
https://www.npmjs.com/advisories/968 web