Directory Traversal in tinyserver2

ALTO 7.5CVE-2017-16085 · GHSA-g8wf-rcg3-qw4q · Published 07/06/2018 · updated 17/06/2026

In breve

CVE-2017-16085 è una vulnerabilità ALTO (CVSS 7.5) che riguarda tinyserver2 (tinyserver2 project), tinyserver2.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.0%, superiore al 80.6% delle vulnerabilità.
Correzione: aggiornare a 0.6.0 o successiva.

Package	Affected versions	Patched versions
tinyserver2 tinyserver2_project	`< 0.6.0`	`0.6.0`
tinyserver2 npm	`< 0.6.0`	`0.6.0`

Description

Affected versions of tinyserver2 resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:

GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo

Recommendation

Update to v0.6.0 or later.

NVD description

tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.

References

nvd.nist.gov/vuln/detail/CVE-2017-16085 · ADVISORY
JacksonGL/NPM-Vuln-PoC · WEB
GitHub Advisory GHSA-g8wf-rcg3-qw4q · ADVISORY
npmjs.com/advisories/371 · WEB
nodesecurity.io/advisories/371 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free