CVE-2022-25931

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada easy-static-server project easy-static-server. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.

Rincian

Terbit di NVD

20 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/lirantal/fdfbe26561788c8194a54bf6d31772c9 exploit · advisory pihak ketiga
• https://github.com/cunjieliu/easyServer/blob/master/index.js%23L27 broken link · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539 exploit · advisory pihak ketiga