Path Traversal in buttle

HIGH 7.5CVE-2018-3766 · GHSA-m8cr-q935-8j67 · Published 05/07/2018 · updated 17/06/2026

In short

CVE-2018-3766 is a HIGH (CVSS 7.5) vulnerability affecting buttle (buttle project), buttle.
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 80.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
buttle buttle_project	`≤ 0.2.0`	No fix yet
buttle npm	`≤ 0.2.0`	No fix yet

Description

All versions of buttle are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths when fetching files.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

NVD description

Path traversal in buttle module versions <= 0.2.0 allows to read any file in the server.

References

nvd.nist.gov/vuln/detail/CVE-2018-3766 · ADVISORY
hackerone.com/reports/358112 · WEB
GitHub Advisory GHSA-m8cr-q935-8j67 · ADVISORY
npmjs.com/advisories/990 · WEB

More vulnerabilities in buttle

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free