Description
A directory traversal vulnerability exists in the production static file server of better-helperjs (<= 3.0.5). Attackers can read arbitrary files located in adjacent directory structures that share the same string prefix as the intended static root directory.
Recommendation
Update the better-helperjs package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.0.5
- Patched version(s): 3.0.6
References
Could your website be exposed too?
SmartScanner can check your website for better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters - Vulnerability
- IPX Allows Path Traversal via Prefix Matching Bypass - CVE-2025-54387
- Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal - CVE-2024-47169
- mcstatic directory traversal vulnerability - CVE-2018-16482
You might also like:
See something that needs correcting? Let us knowUpdated June 26, 2026