Path Traversal in mcstatic

Description

All versions of mcstatic are vulnerable to path traversal.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.0.20

References

• GHSA-3r8f-gphx-9m2c
• hackerone.com
• www.npmjs.com
• CVE-2018-3730
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Path Traversal in localhost-now - localhost-now - GHSA-2gjg-5x33-mmp2 - CVE-2018-3729
• mcstatic directory traversal vulnerability - CVE-2018-16482
• Langchain Path Traversal vulnerability - CVE-2024-7774
• Tina: Path Traversal in Media Upload Handle - CVE-2026-28791

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

mcstatic