Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWoyN2otNHc2bS04ZmM0

Path Traversal in statics-server

All versions of statics-server are vulnerable to Path Traversal. The package fails to limit access to files outside of the served folder through symlinks.

Recommendation

No fix is currently available. Do not use statics-server in production or consider using an alternative module until a fix is made available.

Permalink: https://github.com/advisories/GHSA-j27j-4w6m-8fc4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWoyN2otNHc2bS04ZmM0
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 4 years ago
Updated: almost 2 years ago

Identifiers: GHSA-j27j-4w6m-8fc4, CVE-2019-15596
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-15596
• https://hackerone.com/reports/695416
• https://www.npmjs.com/advisories/1303
• https://github.com/advisories/GHSA-j27j-4w6m-8fc4

Blast Radius: 0.0

Affected Packages