static-dev-server vulnerable to path traversal

ALTO 7.5CVE-2022-25848 · GHSA-7fxm-c848-89q8 · Published 29/11/2022 · updated 17/06/2026

In breve

CVE-2022-25848 è una vulnerabilità ALTO (CVSS 7.5) che riguarda static-dev-server (static-dev-server project), static-dev-server.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 64.8% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
static-dev-server static-dev-server_project	`= 1.0.0`	No fix yet
static-dev-server npm	`= 1.0.0`	No fix yet

Description

A path traversal vulnerability affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory. There is currently no known workaround or fix for this issue.

NVD description

This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory.

References

nvd.nist.gov/vuln/detail/CVE-2022-25848 · ADVISORY
gist.github.com/lirantal/5550bcd0bdf92c1b56fbb20e141fe5bd · WEB
etoah/static-dev-server · PACKAGE
security.snyk.io/vuln/SNYK-JS-STATICDEVSERVER-3149917 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free