Directory traversal in pooledwebsocket

HIGH 7.5CVE-2017-16107 · GHSA-cfxm-4p54-5w7h · Published 07/06/2018 · updated 17/06/2026

In short

CVE-2017-16107 is a HIGH (CVSS 7.5) vulnerability affecting pooledwebsocket (pooledwebsocket project), pooledwebsocket.
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.6% of all vulnerabilities.
Fix: update to 0.0.19 or later.

Package	Affected versions	Patched versions
pooledwebsocket pooledwebsocket_project	`≥ 0.0.1, ≤ 0.0.18`	No fix yet
pooledwebsocket npm	`< 0.0.19`	`0.0.19`

Description

Affected versions of pooledwebsocket resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:

GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo

Recommendation

Update to version 0.0.19 or later.

NVD description

pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

References

nvd.nist.gov/vuln/detail/CVE-2017-16107 · ADVISORY
JacksonGL/NPM-Vuln-PoC · WEB
GitHub Advisory GHSA-cfxm-4p54-5w7h · ADVISORY
npmjs.com/advisories/341 · WEB
nodesecurity.io/advisories/341 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free