Directory Traversal in xtalk

HIGH 7.5CVE-2017-16091 · GHSA-cqv6-7fwc-8m3c · Published 07/06/2018 · updated 17/06/2026

In short

CVE-2017-16091 is a HIGH (CVSS 7.5) vulnerability affecting xtalk (xtalk project), xtalk.
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
xtalk xtalk_project	`≥ 0.0.2`	No fix yet
xtalk npm	`≥ 0.0.2`	No fix yet

Description

Affected versions of xtalk are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL.

Example request:

GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:localhost

Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, and using a different, functionally equivalent package.

NVD description

xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.

References

nvd.nist.gov/vuln/detail/CVE-2017-16091 · ADVISORY
npmjs.com/advisories/339 · WEB
nodesecurity.io/advisories/339 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free