Path Traversal in general-file-server

Description

All versions of general-file-server are vulnerable to path traversal.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.8

References

• GHSA-wv2f-3rxv-jqhp
• hackerone.com
• www.npmjs.com
• CVE-2018-3724
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• PrismJS DOM Clobbering vulnerability - CVE-2024-53382
• Server-Side Request Forgery in axios - CVE-2024-39338
• DOS by abusing `fetchOptions.retry`. - CVE-2023-49800
• Prototype Pollution in querystringify - Vulnerability

Tags:

npm

general-file-server