CVE-2018-16485

MEDIUM

M-server < 1.4.1 - Path Traversal

Title source: rule

Description

Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request.

Exploits (1)

github NO CODE

by bl4de · poc

https://github.com/bl4de/CVEs/tree/master/CVE-2018-16485

View Code ZIP pw:eip

References (1)

[Exploit, Third Party Advisory] https://hackerone.com/reports/319795

Scores

CVSS v3 6.5

EPSS 0.0061

EPSS Percentile 69.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-22

Status published

Products (2)

m-server_project/m-server < 1.4.1

npm/m-server 0 - 1.4.1npm

Published Feb 01, 2019

Tracked Since Feb 18, 2026