Path Traversal in crud-file-server

높음 7.5CVE-2018-3733 · GHSA-vfp9-gwrh-wq9g · Published 29/05/2018 · updated 17/06/2026

요약

CVE-2018-3733은(는) crud-file-server (crud-file-server project), crud-file-server에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 2.2%, 전체 취약점의 82.4%보다 높음.
조치: 0.9.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
crud-file-server crud-file-server_project	`< 0.9.0`	`0.9.0`
crud-file-server npm	`< 0.9.0`	`0.9.0`

Description

Versions of crud-file-server prior to 0.9.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Recommendation

Upgrade to version 0.9.0 or later.

NVD description

crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.

References

nvd.nist.gov/vuln/detail/CVE-2018-3733 · ADVISORY
omphalos/crud-file-server commit 4fc3b40 · WEB
hackerone.com/reports/310690 · WEB
GitHub Advisory GHSA-vfp9-gwrh-wq9g · ADVISORY
npmjs.com/advisories/1003 · WEB

crud-file-server의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free