Path Traversal in crud-file-server

ALTO 7.5CVE-2018-3733 · GHSA-vfp9-gwrh-wq9g · Published 29/05/2018 · updated 17/06/2026

En resumen

CVE-2018-3733 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a crud-file-server (crud-file-server project), crud-file-server.
Probabilidad de explotación en los próximos 30 días (EPSS): 2.2%, mayor que el 82.4% de las vulnerabilidades.
Solución: actualizar a 0.9.0 o posterior.

Package	Affected versions	Patched versions
crud-file-server crud-file-server_project	`< 0.9.0`	`0.9.0`
crud-file-server npm	`< 0.9.0`	`0.9.0`

Description

Versions of crud-file-server prior to 0.9.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Recommendation

Upgrade to version 0.9.0 or later.

NVD description

crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.

References

nvd.nist.gov/vuln/detail/CVE-2018-3733 · ADVISORY
omphalos/crud-file-server commit 4fc3b40 · WEB
hackerone.com/reports/310690 · WEB
GitHub Advisory GHSA-vfp9-gwrh-wq9g · ADVISORY
npmjs.com/advisories/1003 · WEB

Más vulnerabilidades de crud-file-server

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free