CVE-2017-16029

hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3.5 and earlier that allows an attacker to read files outside the current directory by sending `../` in the url path for GET requests.

Score

CVSS 3.0 7.5 High

Status

Modified - support@hackerone.com

Published

2018-06-04

Last modified

2024-09-17

Weaknesses

CWE-22

Affected products

• Hostr Node Module (Hackerone)
• Hostr (Hostr Project)

References

• https://github.com/henrytseng/hostr/issues/8
• https://nodesecurity.io/advisories/303