Path traversal in Node-RED-Dashboard

HIGH 7.5CVE-2021-3223 · GHSA-2hw7-mxvj-m455 · Published 26/01/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
node-red-dashboard nodered	`< 2.26.2`	`2.26.2`
node-red-dashboard npm	`< 2.26.2`	`2.26.2`

Description

In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows ui_base/js/..%2f directory traversal to read files.

NVD description

Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.