Description
All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as ../ to read files outside of the served directory.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 0.0.0
References
- GHSA-44g9-w23c-5rw7
- www.npmjs.com
- en.wikipedia.org
- snyk.io
- CVE-2014-8883
- CWE-23
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- Mammoth is vulnerable to Directory Traversal - CVE-2025-11849
- MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 - CVE-2025-67898
- Directory Traversal vulnerability in serve-lite - CVE-2022-21192
- Directory Traversal in isomorphic-git - CVE-2021-30483
- Tags:
- npm
- nhouston
Anything's wrong? Let us know Last updated on January 09, 2023