Path Traversal in crud-file-server

ÉLEVÉE 7.5CVE-2018-3733 · GHSA-vfp9-gwrh-wq9g · Published 29/05/2018 · updated 17/06/2026

En bref

CVE-2018-3733 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant crud-file-server (crud-file-server project), crud-file-server.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.2%, plus élevée que 82.4% des vulnérabilités.
Correctif : mettre à jour vers 0.9.0 ou plus récent.

Package	Affected versions	Patched versions
crud-file-server crud-file-server_project	`< 0.9.0`	`0.9.0`
crud-file-server npm	`< 0.9.0`	`0.9.0`

Description

Versions of crud-file-server prior to 0.9.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Recommendation

Upgrade to version 0.9.0 or later.

NVD description

crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.

References

nvd.nist.gov/vuln/detail/CVE-2018-3733 · ADVISORY
omphalos/crud-file-server commit 4fc3b40 · WEB
hackerone.com/reports/310690 · WEB
GitHub Advisory GHSA-vfp9-gwrh-wq9g · ADVISORY
npmjs.com/advisories/1003 · WEB

Autres vulnérabilités de crud-file-server

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

crud-file-server

crud-file-server_project

< 0.9.0

0.9.0

crud-file-server

npm

< 0.9.0

0.9.0

Description

Recommendation

Upgrade to version 0.9.0 or later.

NVD description

crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.