CVE-2022-25895

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada lite-dev-server project lite-dev-server. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.

Rincian

Terbit di NVD

21 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120 exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718 exploit · advisory pihak ketiga
• https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134 broken link