high7.5
CVE-2023-26126
m.static Directory Traversal vulnerability
Impact
All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the `requestFile` function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | m.static | <= 2.2.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| M.Static Project | M.Static | through 2.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/lirantal/dcb32c11ce87f5aafd2282b90b4dc998
- https://security.snyk.io/vuln/SNYK-JS-MSTATIC-3244915
- https://github.com/advisories/GHSA-vcxh-qvgr-9fw9
- https://nvd.nist.gov/vuln/detail/CVE-2023-26126
- https://github.com/ivoputzer/m.static/blob/master/index.js#L19