NodeBB vulnerable to path traversal in translator module

MEDIUM 5.0CVE-2021-43788 · GHSA-pfj7-2qfw-vwgm · Published 29/11/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
nodebb nodebb	`≥ 1.0.4, ≤ 1.18.4`	No fix yet
nodebb npm	`≥ 1.0.4, < 1.18.5`	`1.18.5`

Description

Impact

Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected languages/ directory.

Patches

The vulnerability has been patched as of v1.18.5.

Workarounds

Cherry-pick commit hash c8b2fc46dc698db687379106b3f01c71b80f495f to receive this patch in lieu of a full upgrade.

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

NVD description

Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

References

NodeBB/NodeBB security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-43788 · ADVISORY
NodeBB/NodeBB commit c8b2fc4 · WEB
blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot · WEB
NodeBB/NodeBB · PACKAGE
NodeBB/NodeBB release v1.18.5 · WEB
blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free