Description
Missing check vulnerability in the static file handler allows any client to access the files in the server’s file system
Recommendation
Update the @graphql-mesh/http package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.3.19
- Patched version(s): 0.3.19
References
Could your website be exposed too?
SmartScanner can check your website for Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtrac - CVE-2025-25290
- @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Back - CVE-2025-25288
- docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token - CVE-2025-53624
- jsPDF has Local File Inclusion/Path Traversal vulnerability - CVE-2025-68428
You might also like:
See something that needs correcting? Let us knowUpdated February 20, 2025