Description
The development server contains a path traversal vulnerability on Windows when serving files from servedir.
Due to the use of path.Clean() (which only normalizes forward-slash / separators) instead of a Windows-aware path normalization function, it is possible to craft requests using backslashes (\) that bypass the intended directory containment logic.
Recommendation
Update the esbuild package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.27.3, < 0.28.1
- Patched version(s): 0.28.1
References
Could your website be exposed too?
SmartScanner can check your website for esbuild allows arbitrary file read when running the development server on Windows and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @saltcorn/server arbitrary file zip read and download when downloading auto backups - Vulnerability
- esbuild enables any website to send any requests to the development server and read the response - Vulnerability
- webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle - CVE-2024-43373
- @saltcorn/server arbitrary file and directory listing when accessing build mobile app results - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated June 12, 2026