Path Traversal in serve

HIGH 7.5CVE-2019-5415 · GHSA-v588-qcp3-jv46 · Published 21/03/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
serve zeit	`= 6.5.3`	No fix yet
serve npm	`< 7.0.0`	`7.0.0`

Description

Versions of serve prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a /./, which allows attackers to access hidden folders and files.

Recommendation

Upgrade to version 7.0.1 or later.

NVD description

A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allowed access to.

References

nvd.nist.gov/vuln/detail/CVE-2019-5415 · ADVISORY
hackerone.com/reports/330724 · WEB
GitHub Advisory GHSA-v588-qcp3-jv46 · ADVISORY
npmjs.com/advisories/1010 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free