static-server Path Traversal vulnerability

HOCH 7.5CVE-2023-26152 · GHSA-v834-rhv4-65m3 · Published 03/10/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-26152 ist eine Schwachstelle (HOCH (CVSS 7.5)) in static-server (nbluis), static-server.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.4%, höher als bei 71.9% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
static-server nbluis	`≤ 3.0.0`	No fix yet
static-server npm	`≤ 2.2.1`	No fix yet

Description

All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server.js.

NVD description

All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server.js.

References

nvd.nist.gov/vuln/detail/CVE-2023-26152 · ADVISORY
gist.github.com/lirantal/1f7021703a2065ecaf9ec9e06a3a346d · WEB
nbluis/static-server · PACKAGE
nbluis/static-server · WEB
security.snyk.io/vuln/SNYK-JS-STATICSERVER-5722341 · WEB
nbluis/static-server · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free