Directory Traversal in fancy-server

ALTO 7.5CVE-2014-10066 · GHSA-m273-wwfv-h6jp · Published 31/05/2018 · updated 17/06/2026

In breve

CVE-2014-10066 è una vulnerabilità ALTO (CVSS 7.5) che riguarda fancy-server (fancy-server project), fancy-server.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 75.7% delle vulnerabilità.
Correzione: aggiornare a 0.1.4 o successiva.

Package	Affected versions	Patched versions
fancy-server fancy-server_project	`< 0.1.4`	`0.1.4`
fancy-server npm	`< 0.1.4`	`0.1.4`

Description

Versions 0.1.4 and earlier of fancy-server are vulnerable to a directory traversal attack.

Standard attack vectors such as ../ will allow an attacker to read files outside of the served directory.

Recommendation

Upgrade to version 0.1.4 or greater.

NVD description

Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.

References

nvd.nist.gov/vuln/detail/CVE-2014-10066 · ADVISORY
npmjs.com/advisories/9 · WEB
en.wikipedia.org/wiki/Directory_traversal_attack · WEB
nodesecurity.io/advisories/9 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free