high7.5
CVE-2023-26111
node-static and @nubosoftware/node-static vulnerable to Directory Traversal
Impact
node-static and its fork, @nubosoftware/node-static, are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | node-static | <= 0.7.11 | none recorded |
| npm | @nubosoftware/node-static | <= 0.7.11 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| \@Nubosoftware\/Node-Static Project | \@Nubosoftware\/Node-Static | All versions |
| Node-Static Project | Node-Static | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/lirantal/c80b28e7bee148dc287339cb483e42bc
- https://github.com/cloudhead/node-static/blob/master/lib/node-static.js%23L160-L163
- https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-3149928
- https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3149927
- https://github.com/advisories/GHSA-5g97-whc9-8g7j
- https://nvd.nist.gov/vuln/detail/CVE-2023-26111
- https://github.com/cloudhead/node-static/blob/master/lib/node-static.js#23L160-L163