Path Traversal in http-live-simulator

HIGH 7.5CVE-2018-16479 · GHSA-7c9w-qmrq-ff8r · Published 01/02/2019 · updated 17/06/2026

In short

CVE-2018-16479 is a HIGH (CVSS 7.5) vulnerability affecting http-live-simulator (http-live-simulator project), http-live-simulator.
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 76.6% of all vulnerabilities.
Fix: update to 1.0.7 or later.

Package	Affected versions	Patched versions
http-live-simulator http-live-simulator_project	`≤ 1.0.6`	No fix yet
http-live-simulator npm	`< 1.0.7`	`1.0.7`

Description

Versions of http-live-simulator prior to 1.0.7 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. For example: curl --path-as-is http://localhost:8080//../../../../etc/passwd.

Recommendation

Upgrade to version 1.0.7

NVD description

Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL.

References

nvd.nist.gov/vuln/detail/CVE-2018-16479 · ADVISORY
hackerone.com/reports/411405 · WEB
GitHub Advisory GHSA-7c9w-qmrq-ff8r · ADVISORY
nodejs/security-wg · WEB
npmjs.com/advisories/772 · WEB

More vulnerabilities in http-live-simulator

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free