simplehttpserver allows directory traversal and file listing

Description

Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.

Recommendation

Update the simplehttpserver package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.1
• Patched version(s): 0.2.1

References

• GHSA-gpvj-q7fp-jcch
• hackerone.com
• CVE-2018-3787
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Prebid-universal-creative latest on npm briefly compromised - CVE-2025-59039
• Potential XSS vulnerability in jQuery (GHSA-gxr4-xjj5-5px2) - CVE-2020-11022
• Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags - CVE-2021-33295
• Joplin Vulnerable to Cross-site Scripting in Note Content - CVE-2018-1000534

Tags:

npm

simplehttpserver