An open API service providing security vulnerability metadata for many open source software ecosystems.
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
|
npm:http-file-server
PURL:
pkg:npm/http-file-server
|
< 0.2.6 | No known fixed version | |
Affected Version RangesAll affected versions0.1.0, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5 |
|||
All versions of http-file-server are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.
No fix is currently available. Consider using an alternative package until a fix is made available.
References: