What is GHSA-vfp9-gwrh-wq9g?

GHSA-vfp9-gwrh-wq9g is a security advisory published by GitHub Security Advisories with High severity. Path Traversal in crud-file-server

Which CVE IDs does GHSA-vfp9-gwrh-wq9g cover?

GHSA-vfp9-gwrh-wq9g covers the following CVE IDs: CVE-2018-3733. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vfp9-gwrh-wq9g?

GHSA-vfp9-gwrh-wq9g has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-vfp9-gwrh-wq9g?

GHSA-vfp9-gwrh-wq9g affects 1 product, including: npm/crud-file-server:\u003c 0.9.0.

GHSA-vfp9-gwrh-wq9gHighCVSS 7.5

Path Traversal in crud-file-server

Vendor

GitHub Security Advisories

Published

July 18, 2018

Last Modified

March 1, 2023

🔗 CVE IDs covered (1)

CVE-2018-3733 →

📋 Description

Versions of crud-file-server prior to 0.9.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Recommendation

Upgrade to version 0.9.0 or later.

🎯 Affected products1

npm/crud-file-server:< 0.9.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-3733
https://hackerone.com/reports/310690
https://github.com/advisories/GHSA-vfp9-gwrh-wq9g
https://www.npmjs.com/advisories/1003
https://github.com/omphalos/crud-file-server/commit/4fc3b404f718abb789f4ce4272c39c7a138c7a82