better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server

Description

A directory traversal vulnerability exists in the production static file server of better-helperjs (<= 3.0.5). Attackers can read arbitrary files located in adjacent directory structures that share the same string prefix as the intended static root directory.

Recommendation

Update the better-helperjs package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.0.5
• Patched version(s): 3.0.6

References

• GHSA-3p34-w4f6-5xh2
• CWE-22
• OWASP 2021-A1

Related Issues

• Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters - Vulnerability
• IPX Allows Path Traversal via Prefix Matching Bypass - CVE-2025-54387
• Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal - CVE-2024-47169
• mcstatic directory traversal vulnerability - CVE-2018-16482

You might also like:

Exploiting Server Version Disclosure

Better Passive Vulnerability Testing with SmartScanner version 1.7

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Tags:

npm

better-helperjs