Description
resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which allows a malicious user to read content of any file with known path.
References (2)
Core 2
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/pillarjs/resolve-path/commit/fe5b8052cafd35fcdafe9210e100e9050b37d2a0
Exploit, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/315760
Scores
CVSS v3
7.5
EPSS
0.0040
EPSS Percentile
60.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-22
Status
published
Products (2)
npm/resolve-path
0 - 1.4.0npm
resolve-path_project/resolve-path
< 1.4.0
Published
Jun 07, 2018
Tracked Since
Feb 18, 2026