Description
The default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module’s directory being exposed via http routes served by the module.
Recommendation
Update the @fastify/swagger-ui package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0, < 2.1.0
- Patched version(s): 2.1.0
References
Could your website be exposed too?
SmartScanner can check your website for Default swagger-ui configuration exposes all files in the module and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Redoc Prototype Pollution via `Module.mergeObjects` Component - CVE-2024-57083
- files.photo.gallery command injection - CVE-2024-53615
- Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
- @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default - CVE-2026-54504
You might also like:
See something that needs correcting? Let us knowUpdated February 16, 2024