Path Traversal: 'dir/../../filename' in moment.locale

Description

This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.

Recommendation

Update the moment package to the latest compatible version. Followings are version details:

Affected version(s): < 2.29.2
Patched version(s): 2.29.2

References

GHSA-8hfj-j24r-96c4
www.tenable.com
lists.debian.org
lists.fedoraproject.org
security.netapp.com
CVE-2022-24785
CWE-22
CWE-27
CAPEC-310
OWASP 2021-A1
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Path Traversal: 'dir/../../filename' in moment.locale and gives you actionable findings to investigate.

Start a free scan

Related Issues

electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling - CVE-2026-49253
JSZip contains Path Traversal via loadAsync - CVE-2022-48285
Agnai vulnerable to Relative Path Traversal in Image Upload - CVE-2024-47171
IPX Allows Path Traversal via Prefix Matching Bypass - CVE-2025-54387

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated November 04, 2025