Path traversal in Node-RED-Dashboard

ALTO 7.5CVE-2021-3223 · GHSA-2hw7-mxvj-m455 · Published 26/01/2021 · updated 17/06/2026

In breve

CVE-2021-3223 è una vulnerabilità ALTO (CVSS 7.5) che riguarda node-red-dashboard (nodered), node-red-dashboard.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 18.9%, superiore al 97.3% delle vulnerabilità.
Correzione: aggiornare a 2.26.2 o successiva.

Package	Affected versions	Patched versions
node-red-dashboard nodered	`< 2.26.2`	`2.26.2`
node-red-dashboard npm	`< 2.26.2`	`2.26.2`

In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows ui_base/js/..%2f directory traversal to read files.

NVD description

Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.