GHSA-v588-qcp3-jv46

Path Traversal in serve

Source: GitHub Advisory Database (reviewed) High CVE-2019-5415

Packages

Ecosystem	Package	Affected	Fixed in
npm	serve	< 7.0.0	7.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `serve` prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a `/./`, which allows attackers to access hidden folders and files. ## Recommendation Upgrade to version 7.0.1 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-5415 advisory
https://hackerone.com/reports/330724 web
https://github.com/advisories/GHSA-v588-qcp3-jv46 advisory
https://www.npmjs.com/advisories/1010 web