CVE-2022-25931

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.

Score

CVSS 3.1 7.5 High

Status

Modified - report@snyk.io

Published

2022-12-20

Last modified

2025-04-16

Weaknesses

CWE-22

Affected products

• Easy-static-server (Easy-static-server Project)

References

• https://gist.github.com/lirantal/fdfbe26561788c8194a54bf6d31772c9
• https://github.com/cunjieliu/easyServer/blob/master/index.js%23L27
• https://security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539