Description
All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as ../ to read files outside of the served directory.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 0.0.0
References
- GHSA-44g9-w23c-5rw7
- www.npmjs.com
- en.wikipedia.org
- snyk.io
- CVE-2014-8883
- CWE-23
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
- SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522
- Directory Traversal vulnerability in serve-lite - CVE-2022-21192
- Directory Traversal in isomorphic-git - CVE-2021-30483
You might also like:
- Tags:
- npm
- nhouston
Anything's wrong? Let us know Last updated on January 09, 2023