Directory Traversal vulnerability in serve-lite

Description

All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join().

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.0

References

• GHSA-5qq4-m6c3-xxmf
• security.snyk.io
• CVE-2022-21192
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• mongosh vulnerable to local privilege escalation - CVE-2025-1756
• Elliptic's EDDSA missing signature length check - CVE-2024-42459
• Nuxt Devtools has a Path Traversal: '../filedir - CVE-2024-23657
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

serve-lite