NodeBB vulnerable to path traversal in translator module

TRUNG BÌNH 5.0CVE-2021-43788 · GHSA-pfj7-2qfw-vwgm · Công bố 29/11/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-43788 là lỗ hổng mức TRUNG BÌNH (CVSS 5.0) ảnh hưởng nodebb (nodebb), nodebb.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 25.8%, cao hơn 98.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.18.5 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
nodebb nodebb	`≥ 1.0.4, ≤ 1.18.4`	Chưa có bản vá
nodebb npm	`≥ 1.0.4, < 1.18.5`	`1.18.5`

Mô tả

Impact

Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected languages/ directory.

Patches

The vulnerability has been patched as of v1.18.5.

Workarounds

Cherry-pick commit hash c8b2fc46dc698db687379106b3f01c71b80f495f to receive this patch in lieu of a full upgrade.

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

Mô tả của NVD

Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.