GHSA-q7hx-mrv5-6mrp

HashBrown CMS Directory Traversal

Source: GitHub Advisory Database (reviewed) High CVE-2020-5840

Packages

Ecosystem	Package	Affected	Fixed in
npm	hashbrown-cms	< 1.3.2	1.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in HashBrown CMS before 1.3.2. `Server/Entity/Resource/Connection.js` allows an attacker to reach a parent directory via a crafted name or ID field.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-5840 advisory
https://github.com/HashBrownCMS/hashbrown-cms/commit/6b37b73944447bb29c6aaeb086b04196d80c692a web
https://github.com/HashBrownCMS/hashbrown-cms package
https://github.com/HashBrownCMS/hashbrown-cms/compare/v1.3.1...v1.3.2 web
https://github.com/HashBrownCMS/hashbrown-cms/releases/tag/v1.3.2 web