NodeBB vulnerable to path traversal in translator module

中 5.0CVE-2021-43788 · GHSA-pfj7-2qfw-vwgm · 29/11/2021 公開 · 17/06/2026 更新

要点

CVE-2021-43788 は nodebb (nodebb), nodebb に影響する深刻度「中」 (CVSS 5.0) の脆弱性です。
今後30日間に悪用される確率（EPSS）：25.8%（全脆弱性の 98.0% より高い）。
対処：1.18.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
nodebb nodebb	`≥ 1.0.4, ≤ 1.18.4`	修正版なし
nodebb npm	`≥ 1.0.4, < 1.18.5`	`1.18.5`

概要

Impact

Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected languages/ directory.

Patches

The vulnerability has been patched as of v1.18.5.

Workarounds

Cherry-pick commit hash c8b2fc46dc698db687379106b3f01c71b80f495f to receive this patch in lieu of a full upgrade.

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

NVD の説明

Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.