IPX Allows Path Traversal via Prefix Matching Bypass

Description

The approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison.

Recommendation

Update the ipx package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.1.1

  >= 2.0.0-0, < 2.1.1

  < 1.3.2**

• Patched version(s): **3.1.1

  2.1.1

  1.3.2**

References

• GHSA-mm3p-j368-7jcr
• CVE-2025-54387
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• vite allows server.fs.deny bypass via backslash on Windows - CVE-2025-62522
• qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - CVE-2025-15284
• hemmelig allows SSRF Filter bypass via Secret Request functionality - CVE-2025-69206
• React Router has Path Traversal in File Session Storage (GHSA-9583-h5hc-x8cw) - CVE-2025-61686

Tags:

npm

ipx