Path Traversal in statics-server

HOCH 7.5CVE-2019-15596 · GHSA-j27j-4w6m-8fc4 · Published 18/12/2019 · updated 17/06/2026

Kurz gesagt

CVE-2019-15596 ist eine Schwachstelle (HOCH (CVSS 7.5)) in statics-server (statics-server project), statics-server.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.5%, höher als bei 74.8% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
statics-server statics-server_project	`≤ 0.0.9`	No fix yet
statics-server npm	`≤ 0.0.9`	No fix yet

Description

All versions of statics-server are vulnerable to Path Traversal. The package fails to limit access to files outside of the served folder through symlinks.

Recommendation

No fix is currently available. Do not use statics-server in production or consider using an alternative module until a fix is made available.

NVD description

A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory.

References

nvd.nist.gov/vuln/detail/CVE-2019-15596 · ADVISORY
hackerone.com/reports/695416 · WEB
npmjs.com/advisories/1303 · WEB

Weitere Schwachstellen in statics-server

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free