Path Traversal in zero

Description

Versions of zero prior to 1.0.6 are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files.

Recommendation

Update the zero package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.6
• Patched version(s): 1.0.6

References

• GHSA-crf7-fvjx-863q
• www.npmjs.com
• CWE-22
• OWASP 2021-A1

Related Issues

• Flowise: Path Traversal in Vector Store basePath - Vulnerability
• MCPHub has Path Traversal via Malicious MCPB Manifest Name - Vulnerability
• Jan path traversal vulnerability - @janhq/core - CVE-2024-36858
• Path traversal for local publishers in TechDocs backend - Vulnerability

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

zero