IPX Allows Path Traversal via Prefix Matching Bypass

Description

The approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison.

Recommendation

Update the ipx package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.1.1

  >= 2.0.0-0, < 2.1.1

  < 1.3.2**

• Patched version(s): **3.1.1

  2.1.1

  1.3.2**

References

• GHSA-mm3p-j368-7jcr
• CVE-2025-54387
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) 5 - CVE-2020-8203
• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) 3 - CVE-2020-8203
• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) 2 - CVE-2020-8203
• Parse Server exposes the data schema via GraphQL API - CVE-2025-53364

Tags:

npm

ipx