Path Traversal in simplehttpserver

MEDIUM 5.3CVE-2018-16478 · GHSA-vwr2-wj63-86gr · Published 04/12/2018 · updated 17/06/2026

In short

CVE-2018-16478 is a MEDIUM (CVSS 5.3) vulnerability affecting simplehttpserver (simplehttpserver project), simplehttpserver.
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
simplehttpserver simplehttpserver_project	`≤ 0.2.1`	No fix yet
simplehttpserver npm	`≤ 0.3.0`	No fix yet

All versions of simplehttpserver are vulnerable to Path Traversal.

This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL.

No fix is currently available. Do not use simplehttpserver in production or consider using an alternative module until a fix is made available.

NVD description

A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.