| Package | Affected versions | Patched versions |
|---|---|---|
| total.js | < 3.2.3 | 3.2.3 |
| total.js | < 3.2.3 | 3.2.3 |
Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths.
The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml, woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache, manifest, map, ogv, ogg, mp4, mp3, webp, webm, swf, package, json, md, m4v, jsx, heif, heic.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free